assessment, the qualitative approach is the most appropriate. The qualitative approach
does not require heavy mathematics; instead, it thrives more on the people participating
and their backgrounds. Qualitative analysis enables classification of risk that is
determined by people’s wide experience and knowledge captured within the process.
Ultimately, it is not an exact science, so the process will count on expert opinions for its
base assumptions. The assessment process uses a structured and documented approach
and agreed likelihood and consequence evaluation tables. It is also quite common to
calculate risk as a single loss expectancy (SLE) or annual loss expectancy (ALE) by
project or business function.