A risk register with forty open items does not tell you which five deserve your attention this quarter. Once a risk has been identified, someone still has to work out how likely and severe it actually is, otherwise “high risk” becomes a label everyone uses and nobody can defend.
This article explains what risk analysis is, where it sits in the wider risk management process, and how qualitative and quantitative methods differ in practice. By the end, you will know which approach fits your next risk decision, and where the two methods work best together.
- Risk analysis estimates the likelihood and impact of a risk that has already been identified.
- Qualitative risk analysis uses labels such as low, medium and high to rank risks quickly.
- Quantitative risk analysis assigns numbers, such as financial loss estimates, to each risk.
- Most mature risk programmes use qualitative screening first, then quantitative analysis for the highest priority risks.
- Risk analysis feeds directly into risk treatment decisions and reporting to leadership.
- Standards such as ISO 31000 and NIST SP 800-30 recognise qualitative, quantitative and semi-quantitative methods without mandating one.
What is risk analysis
Risk analysis is the stage of the risk management process where an identified risk is examined in detail to estimate likelihood and impact. It comes after risk identification and before risk evaluation, and its output is what lets you compare very different risks, a supplier outage, a phishing attack, a regulatory fine, on the same scale.
Risk analysis is not just a planning exercise. Compliance frameworks such as NIS2, DORA, IMO and ISO 27001 all require organisations to show that risks have actually been analysed, not just listed, before deciding what to do about them. That analysis step is what turns a static risk register into evidence an auditor or regulator can rely on.
Where risk analysis fits
Risk analysis rarely stands alone. It is one stage in a repeatable cycle: identify the risk, analyse its likelihood and impact, evaluate it against your risk appetite, decide how to treat it, then monitor and repeat. In cybersecurity specifically, this cycle is usually run as part of a wider cybersecurity risk assessment that also covers asset inventories, threat intelligence and control testing. Skipping straight from identification to treatment, without a proper analysis step, is one of the most common reasons risk registers stop being useful after a few months.
Qualitative risk analysis explained
Qualitative risk analysis ranks risks using descriptive labels, low, medium, high, critical, based on expert judgement rather than hard numbers. It is fast, does not require historical loss data, and works well when you need to screen a large number of risks quickly, for example during an initial vendor risk assessment before deciding which suppliers need deeper scrutiny. The trade-off is subjectivity: two reviewers can label the same risk differently unless the criteria are defined clearly in advance.
- Risk matrices, which plot likelihood against impact on a simple grid.
- Facilitated workshops, where subject matter experts agree a rating together.
- Heat maps, used to visualise many risks at once for leadership.
Quantitative risk analysis explained
Quantitative risk analysis replaces labels with numbers: a probability of occurrence, a financial loss estimate, or a modelled range of outcomes such as annualised loss expectancy. It takes more time, more data and often dedicated risk assessment software to run, so most organisations reserve it for the risks that qualitative screening already flagged as high priority, where the extra precision is worth the effort. When the underlying data is weak, a quantitative model can look precise while still being wrong, so the inputs matter as much as the maths.
Risk analysis does not remove uncertainty. It replaces a guess with a number you can defend.
Qualitative vs quantitative: which to use
Neither method is inherently better, they answer different questions. Qualitative analysis is the right default for the first pass across a large risk register. Quantitative analysis earns its cost when a decision has a real budget attached, board sign-off, insurance limits, a security investment case, and you have enough data to model it credibly. Many teams run both, in sequence, using qualitative results to decide where quantitative effort is worth spending.
| Factor | Qualitative | Quantitative |
| Speed | Fast, days not weeks | Slower, needs data gathering |
| Data required | Expert judgement | Historical data or reliable estimates |
| Output | Labels (low, medium, high) | Numbers (probability, financial loss) |
| Best used for | Screening large risk registers | High stakes, high cost decisions |
| Main limitation | Subjective, inconsistent between reviewers | Can look precise but rest on weak inputs |
Common pitfalls in risk analysis
Most risk analysis failures are not about the method, they are about discipline. Ratings drift over time if criteria are not documented. Quantitative models get built once and never updated as controls change. And risks that look moderate in isolation get missed because nobody checks them against current conditions, which is why analysis should stay connected to a proper threat and vulnerability assessment, not run as a one-off spreadsheet exercise.
- Undefined criteria that let two reviewers score the same risk differently.
- Static models that are never revisited after controls or threats change.
- Copying scores from a template instead of assessing the actual risk.
Start Your Compliance Journey Today
Frequently Asked Questions
What is risk analysis in simple terms?
Risk analysis is the step where you work out how likely a known risk is to happen and how much damage it would cause, so you can decide which risks need action first.
What is the difference between qualitative and quantitative risk analysis?
Qualitative risk analysis uses labels such as low, medium and high based on expert judgement. Quantitative risk analysis uses numbers, such as probabilities or financial loss estimates, based on data.
Is risk analysis the same as risk assessment?
Not quite. Risk assessment is the broader process of identifying, analysing and evaluating risks. Risk analysis is one stage within that process, focused specifically on likelihood and impact.
Which method should a small business use?
Most small businesses start with qualitative analysis because it is fast and does not require historical data, then apply quantitative analysis only to the small number of risks with real budget or compliance implications.
What is StartComply?
StartComply is a compliance platform that helps businesses manage NIS2, DORA, IMO and ISO 27001 requirements, combining risk analysis, vendor risk management and continuous monitoring in a single system.
How does StartComply help with risk analysis?
StartComply centralises risk data so qualitative ratings and quantitative results live in one place, with reporting that shows auditors and leadership exactly how each risk was analysed and prioritised.
