A city council must decide whether to issue bonds that fund a multi-million-dollar SCADA upgrade and wants a dollar-based annual risk figure for outage exposure. Which analysis approach best fits that decision?

When a city council must decide whether to issue bonds funding a multi-million-dollar SCADA upgrade, decision makers typically need monetary estimates of expected annual loss so they can compare risk reduction to capital cost. Quantitative analysis using single loss expectancy, annualized rate of occurrence, and annualized loss expectancy expresses outage exposure in currency and supports that fiscal conversation. Qualitative labels alone rarely satisfy bond or capital committees that allocate public money. A purely qualitative heat map with red-yellow-green labels and no dollar estimates remains useful for prioritization workshops, but it does not produce the dollar-based annual risk figure the stem asks for. Heat maps rank; they do not by themselves fund or justify bond issuance with ALE-style math. A hallway straw poll of which risks feel scary captures opinion without structured likelihood, impact, or monetary modeling. Informal polling is not a defensible quantitative analysis for public bonding decisions. A one-word risk rating of high without supporting data fails both qualitative rigor and quantitative needs. Without supporting factors, frequency assumptions, or loss estimates, the rating cannot inform a multi-million-dollar SCADA investment decision. Exam caveat: Choose quantitative methods when the question emphasizes currency, annualized loss, capital, or insurance math. Choose qualitative methods when ranking or workshop prioritization is the goal and dollars are not required. Operational check: If leadership requests ALE for SCADA outage exposure, gather credible SLE and ARO inputs with documented assumptions, compute ALE, and present it beside proposed control costs so the council can see residual risk versus upgrade spend.