Qualitative vs Quantitative
Risk assessment is a two step process.
Stage 1 : Initial screening of risk issues can be done with qualitative tools like Risk ranking according to impact, likelihood or other relevant scales.
Stage 2 : Post stage 1, more important risks are analysed using quantitative methods for quantifying the potential loss and accordingly insure against probable loss.
Risk issues can be ranked as per impact, likelihood or other relevant scales.
Impact – refers to the extent to which risk event can affect the enterprise.
Sample Credit : Coso.org
Likelihood – represents the possibility that a given event will occur
Sample credit: Coso.org
Benchmarking – In this method a comparison is done on the basis of risk events of the industry. This lets the enterprise understanding the severity and impact of the possible risk event.
Scenario Analysis – It involves analyzing a event with different assumptions and then study the impact of the event.
Sample Credit: Coso.org
At- Risk Models – Models like Earnings at Risk (EaR), Value at Risk (VaR) are used to assess the value of possible impact using the historical data and help in deciding the maximum exposure levels.
Risk map or a Heat map is a two dimensional diagram with impact and likelihood as dimensions and risks are placed on the heat map considering the potential quantitative loss.
So a heat map is arrived at by combining quantitative and qualitative models and is very helpful in understanding the overall risk issues impacting a enterprise.