nerdexam
Isaca

CGEIT · Question #592

Which of the following situations provides the BEST justification for considering the adoption of a qualitative risk assessment method?

The correct answer is B. It is cost prohibitive to obtain relevant historical quantitative data. A qualitative risk assessment is best justified when it is too costly or impractical to gather the precise numerical data required for a quantitative analysis.

Submitted by luis.pe· Apr 18, 2026Risk Optimization

Question

Which of the following situations provides the BEST justification for considering the adoption of a qualitative risk assessment method?

Options

  • ADetermining a quantitative risk score would require complex calculations
  • BIt is cost prohibitive to obtain relevant historical quantitative data
  • CThere are fewer information assets in the risk register
  • DA higher risk tolerance level has been defined by enterprise leadership

How the community answered

(42 responses)
  • A
    2% (1)
  • B
    83% (35)
  • C
    10% (4)
  • D
    5% (2)

Why each option

A qualitative risk assessment is best justified when it is too costly or impractical to gather the precise numerical data required for a quantitative analysis.

ADetermining a quantitative risk score would require complex calculations

While complex calculations can be a reason to prefer qualitative, the underlying issue is often the data input for those calculations, which option B directly addresses as a cost barrier.

BIt is cost prohibitive to obtain relevant historical quantitative dataCorrect

Qualitative risk assessment methods are valuable when accurate numerical data, such as financial impacts or probability statistics, is unavailable or prohibitively expensive to collect. In such cases, qualitative methods rely on expert judgment, experience, and subjective scales to prioritize risks, providing a practical and cost-effective approach to understanding and managing risk without the need for extensive quantitative data.

CThere are fewer information assets in the risk register

The number of information assets in the risk register doesn't inherently dictate whether qualitative or quantitative methods are more appropriate; either can be applied to varying numbers of assets.

DA higher risk tolerance level has been defined by enterprise leadership

A higher risk tolerance level influences risk response strategies but does not justify the choice of assessment methodology itself.

Concept tested: Risk assessment methodology selection

Topics

#Risk assessment methods#Qualitative risk assessment#Quantitative risk assessment#Data availability

Community Discussion

No community discussion yet for this question.

Full CGEIT Practice