An enterprise has identified a number of plausible risk scenarios that could result in economic loss associated with major IT investments. Which of the following is the BEST method to assess the risk?

Cost-benefit analysis is used to evaluate the economic feasibility of implementing controls, not to directly assess the risk itself or calculate potential economic loss.

Qualitative analysis categorizes risks based on subjective likelihood and impact (e.g., high, medium, low) rather than assigning specific monetary values, making it less precise for assessing direct economic loss.

Business impact analysis (BIA) identifies critical business functions and the impact of disruptions, but it doesn't primarily calculate the probability and monetary loss of specific risk scenarios in the same way quantitative risk analysis does.

Quantitative analysis involves assigning monetary values to assets, threats, vulnerabilities, and potential losses, which directly allows for the calculation of expected economic loss and return on investment for controls. This method provides an objective, financial basis for risk assessment that aligns with the identified concern of economic loss.