CRISC IT Risk Assessment Practice Question
A company is considering using a qualitative risk assessment approach to evaluate IT risks. Which TWO of the following are advantages of qualitative risk analysis over quantitative risk analysis?
⚠ Common exam trap
CRISC often tests the qualitative-versus-quantitative trade-off — candidates confuse 'easy to communicate' with 'comparable across organizations' and pick the wrong advantage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Quick to perform
Option C is correct because qualitative risk analysis relies on relative scales such as High/Medium/Low or ordinal rankings rather than collecting precise monetary values and statistical data, so assessments can be completed quickly with far less data gathering and calculation effort. Option D is correct because qualitative outputs expressed in simple descriptive terms (for example, a risk matrix rating of High) are readily understood by non-technical stakeholders, executives, and business owners who may lack a financial or statistical background. By contrast, option A is wrong because qualitative ratings are subjective and scale-dependent, so results are not easily comparable across different organizations that use different criteria or rating scales. Option B is wrong because financially meaningful results, such as annualized loss expectancy (ALE) derived from single loss expectancy (SLE) and annualized rate of occurrence (ARO), are a hallmark of quantitative analysis, not qualitative. Option E is wrong because qualitative analysis is inherently subjective and depends on expert judgment, making it less objective and repeatable than quantitative methods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Easily comparable across organizations
Why it's wrong here
Qualitative ratings are subjective and organization-specific, limiting comparability.
- ✗
Provides financially meaningful results
Why it's wrong here
Qualitative analysis expresses likelihood and impact in ordinal scales such as high, medium and low, producing no monetary values. It is tempting because quantitative methods like annualised loss expectancy yield financially meaningful figures, but that is precisely the strength qualitative approaches sacrifice.
- ✓
Quick to perform
Why this is correct
Qualitative analysis relies on judgement and descriptive scales rather than numeric modelling, so assessments can be completed quickly without lengthy data gathering or statistical computation. This speed suits broad risk registers where quantitative precision is not justified by available data or budget.
- ✓
Easy to communicate to stakeholders
Why this is correct
Qualitative analysis expresses risk in descriptive scales, such as high, medium or low, rather than monetary values, so results are readily understood by non-technical stakeholders and business owners. This directly satisfies the stem's advantage criterion, since communication ease is a recognised strength of qualitative methods over quantitative analysis, which demands numerical expertise.
- ✗
Objective and repeatable
Why it's wrong here
Subjectivity is a limitation of qualitative analysis.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.