In a quantitative risk assessment, what is the standard approach?

• A. Assign numerical probability and impact values to threats, compute risk scores, and prioritize mitigations using thresholds.
• B. Use only qualitative categories like high/medium/low.
• C. Ignore likelihood and only count incidents.
• D. Risk is a fixed constant not to be updated.

Answer: (A)

In quantitative risk assessment, probability and impact are quantified for each threat, then combined into a numeric risk score and compared against predefined thresholds to determine the order of mitigations. This lets you rank risks on a common scale, justify decisions with numbers, and adjust priorities as data or controls change. A common approach is to multiply probability by impact to get the risk score, with thresholds that translate those scores into actionable actions. Using numbers provides objective comparisons, supports tracking over time, and enables sensitivity analyses.

Relying solely on qualitative labels like high/medium/low sacrifices precision and cross-domain comparability, making it harder to justify prioritization or observe trends. Ignoring likelihood and only counting incidents ignores how often an event might occur relative to its severity. Treating risk as a fixed constant ignores dynamic changes in threats and controls, leaving the assessment outdated as conditions evolve.