How do you decide which information security threats to worry about first when you have dozens of them? This chapter solves that problem by introducing a simple, visual method called qualitative risk analysis, which uses probability and impact matrices—often called heat maps—to sort risks by how urgently they need attention.
Jump to a section
A simple way to picture Qualitative Risk Analysis: Probability and Impact Matrices
A kitchen is the control centre of a dinner party. Every dish, from the roast chicken to the chocolate soufflé, depends on the ingredients, the cook's skill, and the equipment. Before the guests arrive, the host must decide which potential kitchen disasters are worth worrying about and which are just annoying possibilities. This is qualitative risk analysis in action.
The host pulls out a simple two-dimensional grid. On one axis is the probability of each problem: how likely is it that the soufflé will collapse, the roast will burn, or the wine will run out? The host rates each from 'Very Unlikely' to 'Almost Certain'. On the other axis is the impact: what would happen if the soufflé collapsed? The guests would be disappointed but still get dessert. If the roast burns, the main course is ruined—catastrophic impact. The host plots each risk on the grid. A burnt roast lands in the high-probability, high-impact corner, demanding immediate action: set a timer, check the temperature, have a backup pizza in the freezer. The collapsing soufflé, while frustrating, has lower impact and moderate probability, so the host decides to just cross their fingers and have a backup dessert ready. This grid, like a CRISC heat map, turns vague worries into a clear priority list, ensuring the host focuses effort where it will make the biggest difference.
Hosts use this matrix every time they throw a party, just as risk professionals use it to protect an organisation's valuable information. It is not about predicting the future; it is about making smart preparations for the most important 'what ifs'.
Qualitative risk analysis is a way to prioritise risks without using precise numbers or complex calculations. Instead of trying to say 'this cyberattack has a 7.3% chance of happening,' you use your expert judgement to assign a risk a rating like 'High,' 'Medium,' or 'Low' for two separate qualities: how likely it is to happen (probability) and how bad it would be if it did happen (impact).
Think of probability as a scale from 'Rare' to 'Almost Certain.' For example, a small business might rate the probability of a random phishing email reaching an employee as 'Very Likely' because it happens every day. The probability of a targeted ransomware attack from a sophisticated hacking group might be rated as 'Unlikely' for that same small business.
Impact, similarly, is a scale from 'Insignificant' to 'Catastrophic.' The impact of a phishing email that a user immediately reports and deletes could be 'Insignificant' (no damage done). The impact of a ransomware attack that encrypts all the company's customer data and shuts down operations for a week could be rated as 'Catastrophic' (massive financial loss, reputation damage, potential legal action).
To make this more structured, organisations use a probability and impact matrix. This is a simple grid or table. The left column lists the probability ratings (e.g., Very High, High, Medium, Low, Very Low). The top row lists the impact ratings (e.g., Severe, Major, Moderate, Minor, Negligible). For each combination of probability and impact, the cell in the grid gets a colour: typically red for high-risk, yellow for medium-risk, and green for low-risk. This coloured grid is often called a 'heat map' because the 'hottest' risks (those that are both very likely and very catastrophic) glow red.
The key benefit of this method is that it is fast and accessible. It does not require historical data or a statistics degree. A team of people with knowledge about the business and its technology can sit down in a few hours, discuss each risk, and vote on its probability and impact. This discussion itself is valuable because it surfaces assumptions and ensures everyone shares the same understanding of the threats. The main limitation is that it is subjective. Two different analysts might rate the same risk differently. One person's 'Very Likely' might be another's 'Possible.' This is why organisations define each rating level with specific written criteria, like 'Very Likely' meaning 'will occur within the next month,' to reduce ambiguity.
Qualitative analysis replaces purely intuitive guessing. Without a structured approach, people tend to overhype scary but unlikely risks (like a Hollywood-style zero-day attack) and underrate common but annoying risks (like employees reusing passwords). A heat map acts as a reality check, forcing you to consider both probability and impact together. For example, a building fire might have a 'Catastrophic' impact (massive damage, injury, death), but its probability might be 'Rare' because of modern fire safety systems. On the heat map, it might land in a yellow zone. Meanwhile, a data breach from a phishing email might have a 'Moderate' impact but happen 'Almost Daily,' landing it in a red zone and giving it a higher priority.
For the CRISC exam, you need to know that qualitative risk analysis is one of the two main approaches, the other being quantitative risk analysis (which uses numbers). You also need to understand that the output of this process is a priority ranking of risks, which then feeds into the next step in risk management: deciding how to respond to each risk (e.g., avoid, mitigate, transfer, accept).
Identify the Risk
First, you must know what could go wrong. This involves listing potential threats to information systems, like cyberattacks, human error, or natural disasters. Every analysis starts with a clear list of risks to evaluate.
Define the Scales for Probability and Impact
Create a consistent scale, often with 3-5 levels (e.g., Very Low, Low, Medium, High, Very High). Define exactly what each level means in words, so there is no confusion. For example, 'High probability' might mean 'likely to occur within six months.'
Assess Probability for Each Risk
For each risk on your list, use your judgement and available evidence to assign a probability rating from the defined scale. This is a discussion among knowledgeable stakeholders, not a one-person decision.
Assess Impact for Each Risk
Similarly, estimate the potential damage if the risk occurs. Consider financial loss, reputational harm, operational disruption, and legal consequences. Assign an impact rating from the defined scale.
Plot on the Heat Map
Take the probability and impact ratings for each risk and locate the intersecting cell on your matrix. The colour of that cell (red, yellow, green) tells you the risk priority. Record the result in a risk register.
Prioritise and Decide on Responses
Sort the risks by their priority level (red first, then yellow, then green). This ranking informs which risks need immediate mitigation, which can be transferred, and which can be accepted. The outputs feed directly into risk treatment planning.
An IT risk manager at a mid-sized retail company, let's call them Alex, is running a yearly risk assessment. The company has three major systems: an online store, a customer database, and an internal payroll application. Alex gathers the heads of IT, security, and the business for a two-hour workshop. They have a whiteboard with a pre-drawn heat map grid.
First, the team brainstorms risks. They come up with a list:
A ransomware attack on the company's main servers.
An accidental deletion of customer data by a system administrator.
A new privacy law that changes how the company must handle customer data.
A long-term power outage at the data center.
A critical vulnerability in the online store's website code.
Next, Alex walks through each risk. For the ransomware attack:
Probability: The group discusses recent news articles about similar companies being hit. They decide the probability is 'High' because ransomware is very common and the company's security is good but not perfect.
Impact: If all company data is encrypted, the store shuts down for days, customers cannot shop, and the company loses millions in revenue. They rate this impact as 'Major'.
On the heat map, 'High' probability and 'Major' impact land in a red cell. This is a critical risk that requires immediate action, such as improving backups and training staff.
The team moves to the accidental deletion of customer data:
Probability: Alex reviews the access logs. A new administrator might accidentally run a delete command on the wrong database. The team rates this as 'Possible'
Impact: Losing customer data means permanent loss of sales records and marketing lists. They rate this as 'Major' as well.
This also lands in a red cell, but a slightly lower red than the ransomware because 'Possible' is less likely than 'High'. They decide to implement stricter access controls and a 'soft delete' process.
For the new privacy law:
Probability: The law has already passed and will be enforced in six months. This is 'Almost Certain'.
Impact: If the company doesn't comply, it faces fines and lawsuits. They rate this as 'Major' too.
This lands in the highest red cell. The team immediately assigns a project team to ensure compliance.
Finally, the power outage:
Probability: The data center has backup generators and redundant power. A multi-day outage is 'Rare' in their location.
Impact: A complete shutdown could be 'Major', but the probability is so low that it lands in a green or yellow cell.
The team decides to accept this risk and keep monitoring, but not spend a lot of money on additional generators now.
After the workshop, Alex has a ranked list: the privacy law and ransomware are the top priorities. Alex presents this heat map to the company's board, showing clearly which risks need funding and attention. The board approves a budget for new backup systems and a legal compliance project. This structured approach saved the company from investing heavily in earthquake insurance (low probability) when they had an unpatched vulnerability in the store (high probability and impact).
CRISC exam questions on qualitative risk analysis test your understanding of the method's purpose, its components, and how it contrasts with quantitative analysis. The exam does not ask you to calculate complex numbers; it asks you to apply logical reasoning.
Here are the exact concepts you must master:
Definition of qualitative risk analysis: a subjective, judgement-based method using scales (like High, Medium, Low) for probability and impact.
The probability and impact matrix (heat map): know how it is structured (axes, color coding). Understand that the output is a prioritised list, not a monetary value.
The difference between qualitative and quantitative: qualitative uses words/scales, quantitative uses numbers/dollars. The exam loves to present a scenario and ask which approach would be more appropriate (e.g., when you lack data, qualitative is better).
When to use qualitative analysis: it's used for a first-pass analysis, when data is scarce, or for risks that are hard to quantify (like reputation damage).
Common exam traps include:
Confusing probability and impact. A question might say 'the likelihood is high but the consequences are low' and ask what the combined risk level is. You must know that both factors matter.
Assuming a high-probability risk is always high priority. It is only high priority if the impact is also significant. Low-impact but common risks might be low priority.
Mixing up qualitative with quantitative. If a question mentions using 'dollar values' or 'percentages,' it is quantitative, not qualitative.
Thinking a heat map gives you the exact cost of a risk. It does not; it only gives a relative ranking.
Make sure you can identify the output of qualitative analysis. The output is a list of risks ranked by priority (e.g., critical, high, medium, low). This list feeds into the risk response process (CRISC domain 3). The exam often tests the sequence: identify risks, analyse them qualitatively, then respond.
Key definitions to memorise:
Inherent risk: the risk level before any controls are applied.
Residual risk: the risk level after controls are applied.
A qualitative analysis can be done on both inherent and residual risk.
Finally, the exam expects you to know that qualitative analysis is subjective and can be biased. A good CRISC professional validates results with multiple stakeholders and uses a clear, documented scale.
Qualitative risk analysis ranks risks using subjective judgements for probability and impact, without using numerical values.
A probability and impact matrix (heat map) is a grid that combines these two factors to assign a risk level (e.g., high, medium, low) to each threat.
The output of qualitative analysis is a prioritised list of risks, which guides decisions on which risks to treat first.
The main advantage of this method is its speed and simplicity, making it suitable when quantitative data is unavailable.
The main limitation is its subjectivity; different analysts may rate the same risk differently, so clear definitions for each scale level are essential.
Qualitative analysis is used for both inherent risk (before controls) and residual risk (after controls).
A red cell in a heat map indicates a high-priority risk that requires immediate attention, while green cells indicate lower-priority risks that may be accepted.
These come up on the exam all the time. Here's how to tell them apart.
Qualitative Risk Analysis
Uses subjective scales like High, Medium, Low
Faster and simpler to perform
No numerical data required; relies on judgement
Quantitative Risk Analysis
Uses numerical values like percentages and monetary amounts
Requires more time and data
Produces a calculated annual loss expectancy (ALE)
Probability (Likelihood)
Measures how likely a risk is to occur
Is one axis of the heat map
Rated on a scale from Rare to Almost Certain
Impact (Consequence)
Measures the severity of damage if the risk occurs
Is the other axis of the heat map
Rated on a scale from Insignificant to Catastrophic
Inherent Risk
The risk level without any controls applied
Represents worst-case scenario before mitigation
Used to identify necessary controls
Residual Risk
The risk level after controls are applied
Represents realistic ongoing exposure
Used to evaluate control effectiveness
Mistake
Qualitative risk analysis gives you an exact numerical probability like 75%.
Correct
Qualitative analysis uses descriptive scales (e.g., High, Medium, Low), not precise numbers. It is subjective and based on judgement, not on statistical data.
Beginners hear 'analysis' and assume it involves math, like a quantitative approach. They miss the key distinction that qualitative is about ranking, not calculating.
Mistake
A risk with 'High' probability is always more important than one with 'Low' probability.
Correct
Priority is determined by combining probability AND impact. A risk with High probability and Low impact may be less critical than a risk with Medium probability and Catastrophic impact.
People naturally focus on likelihood, but the exam tests that both dimensions matter. This reflects real life where we worry about unlikely but devastating events.
Mistake
A heat map is used to calculate the exact financial loss of a risk.
Correct
A heat map is a prioritisation tool that groups risks into categories (e.g., red, yellow, green). It does not assign monetary values; that is a quantitative technique.
The visual colouring of heat maps makes them feel precise, but they are just relative rankings. Beginners conflate 'priority' with 'dollar value.'
Mistake
Qualitative analysis is only used for small, simple organisations.
Correct
It is used by organisations of all sizes as a first step in risk assessment. Even large enterprises use it for risks that are hard to quantify, such as reputation damage or regulatory changes.
People assume that big companies only use complex math. In reality, qualitative analysis is a standard practice in frameworks like ISO 31000 and COBIT.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No. It uses descriptive scales like 'Low', 'Medium', and 'High' for both probability and impact. It is based on judgement, not on precise numerical calculations.
A heat map is a coloured grid that combines probability and impact ratings to show the overall priority of each risk. High-priority risks appear in red, medium in yellow, and low in green.
Use qualitative analysis when you lack reliable numerical data, when you need a quick first-pass assessment, or when the risks involve hard-to-quantify factors like reputation.
You use expert judgement, considering past incidents, industry trends, and current controls. A team of stakeholders usually discusses each risk and agrees on a rating based on defined criteria.
The main output is a prioritised list of risks, often shown on a heat map. This list tells you which risks are most critical and should be addressed first.
Yes. You can assess the risk level before controls (inherent) and after controls (residual) using the same qualitative method. This helps show how effective your controls are.
You've finished Qualitative Risk Analysis: Probability and Impact Matrices. Continue through the CRISC study guide to build a complete picture of the exam.
Done with this chapter?