Distinguish between qualitative and quantitative risk assessment with a practical example for each.

• A. Qualitative uses descriptive scales; quantitative uses narrative descriptions.
• B. Qualitative uses descriptive scales (low/medium/high) to rank risk.
• C. Qualitative uses descriptive scales (low/medium/high) to rank risk; quantitative uses numerical data (probability, monetary impact) to compute metrics like EMV.
• D. Qualitative uses monetary figures; quantitative uses expert opinions.

Answer: (C)

The key distinction is how risk is quantified and used in decision-making. Qualitative risk assessment relies on non-numeric judgments to categorize and rank risks, typically using descriptive scales such as low, medium, or high. This approach is especially useful when data is scarce or when you want to rapidly prioritize where to focus mitigation efforts.

For a practical example, consider a software development project. Experts might assess the risk of scope creep as medium and the risk of vendor-delivered key components being late as high. These judgments tell you where to concentrate controls and resources, but they don’t assign exact probabilities or dollar amounts.

Quantitative risk assessment, on the other hand, converts risk into numerical values. It uses estimates of probability and monetary impact to compute metrics that support objective comparison and budgeting—most commonly the expected monetary value (EMV).

A practical example here could be a project with a 20% probability of a $100,000 cost overrun. The EMV would be 0.2 times $100,000, or $20,000. When there are multiple risks, you can sum their EMVs to understand the overall expected impact and to evaluate different mitigation options in monetary terms.

This combination—qualitative ranking with descriptive scales for the first approach, and quantitative probability and monetary data leading to EMV for the second—explains why the best answer describes qualitative as using descriptive scales to rank risk and quantitative as using numerical data to compute metrics like EMV.