Qualitative risk assessment rates risks using descriptive categories: a likelihood scale (rare, unlikely, possible, likely, almost certain) and a consequence scale (insignificant, minor, moderate, major, catastrophic). The combination produces a risk rating (low, medium, high, extreme) that helps organisations prioritise their response. Quantitative risk assessment assigns numerical values: probability percentages, financial impact ranges and statistical distributions that can be modelled. The ISO 31000:2018 risk management standard supports both approaches and recommends selecting the method that is proportional to the level of risk, the importance of the decision and the availability of data. Neither is inherently superior. The question is which one fits the decision.
How does qualitative assessment work?
Qualitative assessment uses a risk matrix to combine likelihood and consequence ratings into an overall risk level. The assessor applies judgement, informed by experience and available evidence, to place each risk on the matrix. The output is a prioritised risk register that shows which risks require immediate attention, which require monitoring and which are within acceptable tolerance.For example, the NSW Audit Office Local Government 2025 report found that councils are required to identify and effectively manage risks to mitigate threats to assets, reputation and operational continuity. For most council governance decisions, a qualitative risk assessment that rates risks against a consistent matrix provides sufficient information to guide resource allocation and escalation. The strengths of the qualitative approach are speed (it can be completed in a workshop), accessibility (non-technical stakeholders can participate) and communication (a colour coded risk matrix is immediately understandable).
How does quantitative assessment work?
Quantitative assessment assigns numerical values to risk parameters. A cyber security risk might be modelled as a 15 per cent probability of occurrence in any given year with an estimated financial impact between $2 million and $8 million. Monte Carlo simulation can then model the range of possible outcomes across all identified risks, producing a probability distribution of total risk exposure. The Infrastructure Australia assessment framework uses quantitative methods for cost benefit analysis and risk adjusted financial appraisal of major infrastructure proposals.The strengths of quantitative assessment are precision (it produces numerical outputs that can be compared across risks and across time periods), defensibility (the assumptions and data are explicit) and applicability to financial decisions (it directly informs insurance, capital allocation and investment appraisal). The limitation is that it requires data. A quantitative model built on assumptions rather than historical data produces a false sense of precision.
When should you use each method?
Use qualitative assessment when the decision requires prioritisation rather than precision, when the audience is non-technical, when data is limited or when speed matters. Use quantitative assessment when the decision involves significant financial exposure, when the audience needs numerical confidence intervals, when data is available to support the model and when the risk assessment feeds directly into a financial appraisal such as a business case or insurance valuation.

The OLG risk management guidelines require councils to have a risk management framework but do not prescribe a specific assessment methodology. In practice, most councils use qualitative methods for their enterprise risk registers and may apply quantitative methods for specific high value decisions such as asset renewal modelling or insurance program design.

The most effective practitioners use both. Qualitative methods set the strategic priorities. Quantitative methods provide the financial evidence when a specific decision demands it. The Statewide Mutual framework analysis emphasises that an operational and effective risk management framework supports proper governance regardless of which assessment methodology is used.
How can professionals build risk assessment capability?
AcademyGlobal (AG), the Chartered Institute of Procurement & Supply (CIPS) Centre of Excellence for Australia, New Zealand and Southeast Asia, delivers programs that build risk assessment capability across both methods. AG’s Risk Management Fundamentals program provides the structured foundation for risk identification, qualitative assessment and treatment. For professionals who need to apply risk assessment at the strategic and organisational level, AG’s Strategic Risk Management courses address how to select the appropriate methodology for the decision at hand.

The professionals who add the most value are not the ones who can operate one methodology. They are the ones who know when to use each and can explain why.
Frequently asked questions
What is the difference between qualitative and quantitative risk assessment?

Qualitative assessment uses descriptive scales (likelihood and consequence matrices) to rate and prioritise risks. Quantitative assessment uses numerical values (probabilities and financial impacts) to model risk exposure. Both are valid under ISO 31000.

Which method is better?

Neither is inherently superior. The choice depends on the decision being supported, the data available and the audience. Qualitative is faster and more accessible. Quantitative is more precise and more defensible for financial decisions.

What method do Australian councils use?

Most councils use qualitative methods for their enterprise risk registers. Quantitative methods are used for specific high value decisions such as asset renewal modelling or insurance program design.

Can you use both methods together?

Yes. The most effective approach uses qualitative methods to set strategic priorities and quantitative methods to provide financial evidence when specific decisions demand it.

Where can I build risk assessment skills?

AcademyGlobal’s Risk Management Fundamentals program covers risk identification, qualitative assessment and treatment as a structured foundation.
References

1. ISO, “ISO 31000:2018 Risk Management,” International Organization for Standardization
2. NSW Audit Office, “Local Government 2025,” July 2026
3. Infrastructure Australia, “Assessment Framework”
4. OLG NSW, “Guidelines for Risk Management and Internal Audit”
5. Statewide Mutual, “New Risk Management Framework for NSW Councils,” November 2019