CRISC IT Risk Assessment Practice Question
Which of the following is a limitation of quantitative risk analysis?
⚠ Common exam trap
CRISC often tests the confusion between qualitative and quantitative limitations—candidates incorrectly attribute subjectivity and communication difficulty (qualitative weaknesses) to quantitative analysis, or mistake its financial comparability for a drawback.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It is data-intensive and time-consuming.
Quantitative risk analysis assigns numeric, often monetary, values to risk using models such as ALE (SLE × ARO) or Monte Carlo simulation. Its principal drawback is that it requires substantial historical loss data, asset valuations, and modeling effort, making it resource-intensive and slow to perform compared with qualitative approaches like risk matrices. This data dependency and time cost is the recognized limitation tested here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Results are not comparable across organizations.
Why it's wrong here
Quantitative results are expressed in monetary terms, so they can be aggregated and compared across organisations using the same currency and annualised loss basis. It is tempting because qualitative scales do differ between assessors, which is the limitation of qualitative analysis, not quantitative.
- ✓
It is data-intensive and time-consuming.
Why this is correct
Quantitative risk analysis assigns monetary values and probabilities, requiring substantial historical loss data, modelling expertise, and calculation effort. This data-intensive, time-consuming nature limits its practicality, satisfying the stem's request for a genuine limitation rather than a benefit of the quantitative approach.
- ✗
It is subjective and difficult to communicate.
Why it's wrong here
Quantitative analysis produces numeric, financially expressed values that are readily communicated to management and are derived from data rather than judgement. It is tempting because subjectivity and poor communication are genuine weaknesses, but they belong to qualitative risk analysis.
- ✗
It does not provide financially meaningful values.
Why it's wrong here
Quantitative analysis exists precisely to express risk as monetary values, such as annualised loss expectancy, giving financially meaningful figures for decision-making. It is tempting because qualitative ratings lack financial meaning, which is that method's limitation rather than quantitative analysis's.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.