What is qualitative risk analysis and what purpose does it serve?

• A. A subjective assessment of risk probability and impact to prioritize risks for further analysis and response planning.
• B. A numerical calculation of expected monetary value.
• C. A process for creating a risk response plan.
• D. A document listing risks.

Answer: (A)

Qualitative risk analysis involves subjectively assessing the probability of each risk and its impact using descriptive scales, then using those assessments to rank or prioritize risks for further analysis and for planning responses. This approach helps focus attention and resources on the most significant threats without needing numerical data. It often uses tools like a probability‑impact matrix to assign a priority level to each risk, guiding where to dig deeper (for example with quantitative analysis) or how to allocate mitigation efforts.

This is different from numerical calculations of monetary value, which are part of quantitative risk analysis. It isn’t the step where you create a risk response plan, nor is it merely a list of risks—that would be a risk register.