When to Use Which Risk Assessment Technique

Qualitative risk assessment is well- | suited for several types of situations:

• Newness is when the activities, context, / marketplace, or organization itself is just too new to have any significant track record of experiences to use for measurement. (Innovators and entrepreneurs are prone to this argument.)
• Uniqueness is when the organization (or its key leaders or managers) believe that their way of doing business or their products or services are so singular that no other experience in the industry or marketplace can compare. (Organizations highly reliant on trade secrets can be prone to this argument.)
• There is not enough time, money, or talent available to take all the measurements needed for a sound quantitative estimate.
• There is no reliable, accurate measuring method that can be used to gather enough data.

Quantitative risk assessment is wellsuited for other types of situations:

• Business processes involved with the risks in question are well understood.
• Measurement techniques are available and have the required precision and reliability.
• Experience with the processes in question will produce a large enough quantity of data samples to produce a statistically significant result.

That last point under quantitative is the pivot point: It asserts that without a sufficiently large enough sample size, the quantitative risk assessment will not be statistically significant. This is equivalent to saying that unless you can estimate risks to a "six nines" degree of precision and accuracy, it is wrong to attempt a quantitative risk assessment at all.

Sometimes as few as two or three measurements good to one significant digit are all you can get in the time you have available. That will tell you more about the nature of that risk, the advocates of quantitative risk assessment argue, than any larger set of qualitative, subjective, anecdotally derived risk estimates can.