CRISC IT Risk Assessment Practice Question
A company is performing a qualitative risk analysis for a new cloud migration project. Which TWO of the following are recognized limitations of qualitative risk analysis?
⚠ Common exam trap
CRISC often tests whether candidates confuse limitations of qualitative vs. quantitative analysis — the trap is attributing quantitative traits (historical data, financial precision) to qualitative methods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk ratings are not easily comparable across different organizations
Option A is correct because qualitative risk analysis produces ordinal ratings (such as High/Medium/Low) that are defined by each organization's own scales and risk criteria, so the resulting ratings lack a common quantitative baseline and cannot be reliably compared across different organizations. Option D is correct because qualitative analysis relies on expert opinion, experience, and judgment rather than numeric measurement, making the ratings inherently subjective and dependent on the assessor's bias, expertise, and interpretation. Options B, C, and E are not limitations of qualitative analysis: it is specifically chosen because it requires little historical data (B is wrong), it is generally faster and simpler than quantitative analysis (C is wrong), and it does not produce financially precise loss estimates—that is the domain of quantitative risk analysis using techniques like Monte Carlo simulation or expected monetary value (E is wrong).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Risk ratings are not easily comparable across different organizations
Why this is correct
Qualitative ratings rely on subjective scales and organisational context, so a 'high' in one company rarely maps to a 'high' elsewhere. This subjectivity prevents meaningful cross-organisational comparison, satisfying the limitation that ratings are not easily comparable between different organisations.
- ✗
It requires extensive historical data
Why it's wrong here
Qualitative analysis deliberately avoids quantitative inputs, relying on ordinal scales and expert judgement, so extensive historical data is not a prerequisite. It is tempting because quantitative methods such as Monte Carlo simulation do demand historical loss data, but that requirement belongs to those techniques, not to the qualitative limitation being asked about.
- ✗
It is time-consuming and complex to perform
Why it's wrong here
Qualitative analysis is typically fast and straightforward, relying on subjective scales rather than lengthy quantitative modelling, so calling it time-consuming and complex misstates its nature. It tempts because quantitative analysis, with data gathering and statistical modelling, genuinely carries that cost.
- ✓
Results are subjective and depend on the assessor's judgment
Why this is correct
Qualitative analysis ranks risks using ordinal scales derived from assessor opinion, so outputs vary between practitioners and cannot be independently verified. This inherent reliance on human judgement is the recognised limitation, unlike quantitative methods that produce reproducible numeric values.
- ✗
It provides financially precise loss estimates
Why it's wrong here
Qualitative analysis produces ordinal ratings such as high, medium or low; it cannot express monetary loss values. It is tempting because both approaches rank risks, but financial precision is the defining strength of quantitative analysis, which uses monetary loss distributions — the opposite of a qualitative limitation.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.