ISO/IEC 27005 Qualitative vs Quantitative Risk Analysis

ISO/IEC 27005:2022 permits qualitative analysis using defined attributes, quantitative analysis using numerical values, and semiquantitative analysis using qualitative scales with assigned values. It does not make one approach inherently more conformant. The organization documents the chosen approach and uses criteria detailed enough to produce repeatable, valid, and comparable results.

Risk levels can be qualitative, such as very high, high, medium, and low, or quantitative, such as expected monetary loss, loss of life, or market share over a stated period. Both need a reference scale understood by interested parties and periodic calibration. Qualitative levels should be unambiguous, non-overlapping, and expressed in objective language.

ISO/IEC 27005 is guidance, while ISO/IEC 27001 contains the certifiable ISMS requirements. ISO/IEC 27001 requires consistent, valid, and comparable results but does not mandate a heat map, 1-to-5 matrix, Monte Carlo simulation, or financial risk model.

For any method, record the purpose, scope, scenario, owner, time horizon, risk criteria, source evidence, assumptions, uncertainty, result, treatment decision, approval, and review trigger. Define every category, threshold, unit, and combination rule so another competent assessor can reproduce the reasoning.

For quantitative work, also retain data provenance, elicited estimates, ranges or distributions, model logic, calculation or simulation settings, sensitivity, validation, and known limitations. For qualitative work, retain the rationale and evidence behind each rating, examples anchoring the categories, and any equivalence used across different scales.

Start with the decision. Qualitative analysis is often enough for broad inventories, rapid screening, or communication where clear categories separate treatment priorities. Quantitative analysis is useful when the decision depends on the size and distribution of possible loss, a cost-benefit comparison, a treatment budget, or the difference between close options.

Use a combined approach when it reduces effort without hiding material risk. For example, screen a large inventory with calibrated qualitative criteria, then quantify the scenarios near an acceptance threshold or those tied to large investment decisions. Evaluate every result against approved criteria and keep the accountable risk owner separate from the analyst.

Apply an explicit branch. If well-defined categories clearly separate accept, treat, and escalate outcomes, use the qualitative method. If two options remain close, the exposure crosses a material threshold, or cost and benefit depend on the range of possible loss, quantify the selected scenario. If data are sparse, use ranges and record expert judgment and uncertainty instead of manufacturing a precise point estimate.

Numbers do not make weak evidence objective, and labels do not excuse vague reasoning. Do not multiply or average ordinal 1-to-5 ratings as if the intervals and ratios were measured quantities. Do not compare a 'high' rating from one scale with a 'high' rating from another until their definitions and thresholds are mapped.

Avoid a single-point estimate when a range would show material uncertainty. Do not buy extra precision that cannot change the decision. A rough but traceable estimate can be sufficient, while a detailed model can still be misleading when subjective judgments or unknown dependencies are hidden.

Review the method and the affected assessments when the decision, scope, criteria, data, threat conditions, controls, assumptions, time horizon, or acceptance thresholds change. Also review it when independent assessors cannot reproduce the result, when similar risks produce incomparable results, or when the model's precision does not improve the decision. ISO/IEC 27005 sets no universal annual method-review deadline; use a planned cadence and change-driven triggers appropriate to the ISMS.