prioritization or comparison within the set of reported risks difficult

Risk, and its contributing factors, can be assessed in a variety of ways, including quantitatively,
qualitatively, or semi-quantitatively. Each risk assessment approach considered by organizations
has advantages and disadvantages. A preferred approach (or situation-specific set of approaches)
can be selected based on organizational culture and, in particular, attitudes toward the concepts of
uncertainty and risk communication. Quantitative assessments typically employ a set of methods,
principles, or rules for assessing risk based on the use of numbers—where the meanings and
proportionality of values are maintained inside and outside the context of the assessment. This
type of assessment most effectively supports cost-benefit analyses of alternative risk responses or
courses of action. However, the meaning of the quantitative results may not always be clear and
may require interpretation and explanation—particularly to explain the assumptions and
constraints on using the results. For example, organizations may typically ask if the numbers or
results obtained in the risk assessments are reliable or if the differences in the obtained values are
meaningful or insignificant. Additionally, the rigor of quantification is significantly lessened
when subjective determinations are buried within the quantitative assessments, or when
significant uncertainty surrounds the determination of values. The benefits of quantitative
assessments (in terms of the rigor, repeatability, and reproducibility of assessment results) can, in
some cases, be outweighed by the costs (in terms of the expert time and effort and the possible
deployment and use of tools required to make such assessments).
In contrast to quantitative assessments, qualitative assessments typically employ a set of methods,
principles, or rules for assessing risk based on nonnumerical categories or levels (e.g., very low,
low, moderate, high, very high). This type of assessment supports communicating risk results to
decision makers. However, the range of values in qualitative assessments is comparatively small
in most cases, making the relative prioritization or comparison within the set of reported risks
difficult. Additionally, unless each value is very clearly defined or is characterized by meaningful
examples, different experts relying on their individual experiences could produce significantly
different assessment results. The repeatability and reproducibility of qualitative assessments are
increased by the annotation of assessed values (e.g., this value is high because of the following
reasons) and by the use of tables or other well-defined functions to combine qualitative values.