Qualitative risk analysis is a process which draws on the skills, knowledge and experience of key stakeholders to identify:
- hazards and unwanted events;
- the most plausible (worst case) consequence severity;
- the likelihood/probability of that particular consequence severity occurring; and
- current implemented risk control measures.
Using a pre-defined matrix a risk score is then allocated to each of the hazards/ unwanted events based on the input of the stakeholders and does not involve the numerical probabilities.
Once this analysis is complete a decision is made as to whether the risk outcome is tolerable for the business. If it is deemed to be intolerable, additional risk control measures shall be implemented until the business decision makers are comfortable with the residual risk.