-: To determine the exact amount of risk that exists,
we can conduct a formalized risk analysis or assessment.
During this assessment,
there are two different ways to measure risk,
qualitatively and quantitatively.
In this lesson,
we're going to focus on the qualitative method
of risk analysis.
Qualitative risk analysis uses intuition,
experience and other best practices
to assign relative values to a given risk.
These values could be low, medium, high and critical.
Or you can use any other designated
categorization system that you want.
You can even use numbers.
But numbers aren't really an exact measure in this case.
For example, if I asked you to score this lesson,
you can give it a one through a five star rating.
This isn't a mathematical analysis,
it's just a number that's representing your opinion,
with five being great and one being horrible.
Therefore, it's qualitative in nature,
not quantitative in nature.
The best practices here include
techniques to measure risk such as
brainstorming sessions, focus groups, surveys,
interviews and estimating the likelihood of events.
When you're conducting qualitative risk analysis
it's important that the team
has the required experience and education
of the threats being analyzed,
since this is a highly subjective thing.
The analysts must use their experience
to rank the threats
based on a proposed impact severity,
the loss potential and the likelihood of occurrence.
The big downside when using a qualitative risk analysis
is that dollar values are simply not provided.
And this hinders a cost benefit analysis,
and future budget forecasting.
So, let's take a non technical example,
to really drive home the idea
of a qualitative risk assessment.
Today I want you to imagine that you're home
with a two year old child,
and they're running around your house.
You're busy cooking dinner
and on the stove there's a pot of boiling water
you're going to put some spaghetti noodles in.
But, you need to go to the restroom.
Should you walk away from the stove
to use the restroom,
or should you take some actions
to prevent that two year old from running over to the stove
while you're out of the room,
knocking over that pot of boiling water onto themselves,
and requiring you to take a trip to the hospital tonight?
Well, experience probably tells you
that you should mitigate the vulnerability
of a hot stove and a boiling pot of water
from the threat of this hyperactive two year old
running around you're house.
You didn't really need to sit down
and calculate the temperature of the stove,
the volume of the water in the pot,
the speed at which the child can run,
how fast it's boiling,
the time it would take you to use the bathroom,
and do some kind of complex mathematical algorithm
to determine the risk here, right?
After all, the numbers here really aren't that important.
What is important is the idea
behind qualitative risk analysis.
We can use our experience,
and our general categories for risk
to determine if it's probably pretty high risk
for us to leave this two year old,
unattended, with a stove and a pot of boiling water.
Most of us would agree it is.
Using this example,
I'm going to classify the risk as high.
Because if I leave the room,
there's a high probably that this threat,
our two year old,
is going to explore the kitchen
and burn themselves on the stove,
or knock that boiling water off,
and get it on to themselves.
Then, I consider the impact.
If this occurs, my dinner would be ruined.
That's a pretty low impact.
But, there's also a good chance
that this two year old could be badly burned,
and that's a high impact event.
So I have a high likelihood, and a high impact.
Looking at this, that means that we're in the red area.
This is a high risk event, and therefore,
we need to put some mitigation's in place
to lower this risk down
to something that's medium, or low
before I walk away from that stove
and head to the bathroom.
Maybe I'm going to transfer the risk
by calling my wife downstairs,
and have her watch the stove and keep the kid away.
Maybe I'm going to avoid the risk all together,
by simply deciding I'm not going to leave,
and I'm going to hold it and not go to the rest room
until I'm finished cooking this meal,
and put everything away safely.
Or, maybe I'm just going to be a horrible parent
and I'm simply going to accept the risk,
knowing that the child is probably going to get hurt
and probably going to ruin my dinner.
Now, I'm not going to do that
because that's not a really good idea.
But, you know, that is an option.
You could accept the risk.
I wouldn't recommend it in this case,
because we don't want the kid to get hurt.
Now, notice we never considered numbers here.
It was all about experience, and judgment,
and relative categories of high,
and medium, and low that we used.
If you see this type of relative comparison on the exam,
this is a dead giveaway that you're being asked
about qualitative analysis.