Qualitative vs quantitative risk assessment
The risk assessment core of the risk management process involves, identifying, analysing and evaluating risks - not to understand or quantify them so much as to inform the subsequent management decisions about how to handle them.
Unless those managers who will make the decisions understand, trust, value and utlimately use the information provided by the analysts, risk assessment is a pointless, costly exercise. Providing useful information to support decisions is thus a pragmatic risk assessment objective.
Laborious analytical processes based on obscure statistics, models, simulations, baseless assumptions and unrealistic extrapolations may be self-defeating, particularly if, despite all the effort, the analyses turn out to be no more accurate or beneficial for the purpose than simpler, quicker, dirtier methods.
There are tradeoffs here. Rigorous, quantitative risk analysis may be worthwhile in situations where:
- There is sufficient high-quality information about the risks being assessed;
- Subsequent risk treatment decisions are critically important, with severe adverse consequences arising from errors;
- The necessary analytical resources (time and expertise) are available and engaged in the process;
- The risks are stable; and
- Qualitative analysis has proven inadequate or unsuitable for some reason.
Otherwise, qualitative methods may suffice.
It is feasible to do both such as a quick qualitative review to get started (and perhaps start mitigating the most significant risks), followed by quantitative analysis to explore some risks in greater detail, revising the risk treatments accordingly. If several analytical methods are used, comparing the results may indicate intriguing differences suggesting methodological errors or limitations, such as misleading assumptions or additional risk factors - opportunities for improvement.
A further improvement opportunity is usually missed altogether - namely using outcomes of the entire process to validate the method/s used.