Qualitative Risk Analysis.

A risk analysis approach that rates likelihood and impact using descriptive scales such as low/medium/high or 1-5, rather than monetary or probabilistic values. It belongs to the Compliance & Frameworks category of cybersecurity.

A risk analysis approach that rates likelihood and impact using descriptive scales such as low/medium/high or 1-5, rather than monetary or probabilistic values.

Qualitative risk analysis is the most common method used in cyber and information risk programs because it is fast, intuitive, and easy to communicate. Practitioners use ordinal scales for likelihood and impact, plot risks on a heat map, and discuss them with business owners. It is well suited for emerging risks, small organizations, or initial triage where data is sparse. The trade-off is subjectivity: ratings depend on expert judgement and can produce inconsistent results across teams. Mature programs anchor the scales with clear criteria (financial loss bands, customer impact, regulatory consequences) and combine qualitative views with quantitative analysis for top risks.

Defences for Qualitative Risk Analysis typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Risk heat map, Qualitative risk assessment.