Which approach uses numeric values and distributions to compute numerical risk scores?

Which approach uses numeric values and distributions to compute numerical risk scores?

• A. Qualitative risk matrix.
• B. Event tree analysis.
• C. Quantitative risk matrix.
• D. Risk appetite statement.

Answer: (C)

This item tests quantifying risk by turning uncertainty into a numeric score through probabilities and impacts. A quantitative risk matrix uses numeric scales for both likelihood and consequence and leverages probability distributions to capture uncertainty in those inputs. By combining these elements, it produces a numerical risk score—often interpreted as expected loss or a distribution of possible scores via methods like Monte Carlo simulation. This lets you compare risks on a precise scale and understand how uncertainty affects outcomes. Qualitative risk matrices, in contrast, rely on categories like high/medium/low without specific numbers, so they don’t produce a numeric score. Event tree analysis maps out pathways and associated probabilities and outcomes to explore how events could unfold, but it’s about structure and pathways rather than computing a single numeric risk score. A risk appetite statement states how much risk an organization is willing to accept, without deriving numeric risk scores from probabilistic inputs. So, the approach that uses numeric values and distributions to compute numerical risk scores is the quantitative risk matrix.

This item tests quantifying risk by turning uncertainty into a numeric score through probabilities and impacts. A quantitative risk matrix uses numeric scales for both likelihood and consequence and leverages probability distributions to capture uncertainty in those inputs. By combining these elements, it produces a numerical risk score—often interpreted as expected loss or a distribution of possible scores via methods like Monte Carlo simulation. This lets you compare risks on a precise scale and understand how uncertainty affects outcomes.

Qualitative risk matrices, in contrast, rely on categories like high/medium/low without specific numbers, so they don’t produce a numeric score. Event tree analysis maps out pathways and associated probabilities and outcomes to explore how events could unfold, but it’s about structure and pathways rather than computing a single numeric risk score. A risk appetite statement states how much risk an organization is willing to accept, without deriving numeric risk scores from probabilistic inputs.

So, the approach that uses numeric values and distributions to compute numerical risk scores is the quantitative risk matrix.