Differentiate between risk quantification and risk prioritization.

• A. Quantification assigns numeric values; prioritization ranks risks to allocate attention and resources.
• B. Prioritization assigns numbers; quantification ranks.
• C. They are the same.
• D. Quantification is optional; prioritization is mandatory.

Answer: (A)

Risk quantification puts numbers on risk by estimating probability and impact and turning them into a numeric score. This creates a common scale to compare very different risks objectively. Risk prioritization uses those quantified results to rank which risks deserve attention first, so resources, time, and controls go to the highest-priority items. In other words, numbers help you compare, and the ranking tells you what to do first. It’s common to quantify risk to some extent and then use that ranking to decide actions; you don’t necessarily need perfect precision for prioritization, but the ordering relies on the scores. For example, a risk with a higher score would typically be addressed before one with a lower score.