How do you perform a basic risk assessment using qualitative methods?

• A. Assign a numeric score to risk using an exact formula.
• B. Identify threats, vulnerabilities, impacts, likelihood, and calculate risk as a combination for prioritization.
• C. List all assets and assign ownership.
• D. Implement controls first and assess later.

Answer: (B)

Qualitative risk assessment uses descriptive scales to evaluate risk rather than numbers. The right approach is to identify potential threats and the vulnerabilities that could be exploited, consider the potential impacts if those threats materialize, and estimate how likely each scenario is. By combining likelihood with impact, you can prioritize risks based on relative severity using qualitative judgments (for example, low/medium/high) without relying on precise numerical formulas. This focus on description and prioritization fits qualitative methods.

Numerical scoring with an exact formula is a quantitative approach, not qualitative. Simply listing assets and ownership covers asset identification rather than assessing risk. Implementing controls before assessing risk skips the essential evaluation step.