A qualitative analysis will generally involve a subjective level of assessment. The classic Kastle-Meyer test uses phenolphthalein to check for blood—it is quick and cheap and eliminating expensive and specious DNA testing save times and money. Quantitative analysis, as the name implies, uses measurements to assess the topic of concern. Both have their place in our toolboxes.

Qualitative risk analysis can be as simple as Johari window with two axes used to provide four categories; for example, the famous sequence of “not urgent—not important,” “urgent—not important,” “not urgent—important,” and “urgent—important.” A more sophisticated approach might assign numerical values in an attempt to scale the level of risk as occurs when we do a failure mode and effects analysis (FMEA), which often parades itself as quantitative but is really largely qualitative. We are not implying that qualitative approaches are somehow less than quantitative approaches—they have the benefit of being quick and inexpensive and, if they are enough, they are all we may need.

Quantitative risk analyses have the difficulty of requiring some level of historical data. For example, we can construct a Markov chain of probabilities for a reliability failure, but if we are guessing at the probability values, we are right back to qualitative assessments. Hence, for a quantitative risk analysis to function well, we must already be measuring sufficient data to use the probabilities. In some cases, we can improve FMEA by retaining historical data about our product behavior. If such is the case, we need to be consistent in our application of historical values (and use a modicum of common sense!).

We recommend a two-pronged approach: assess risk initially with a qualitative approach and only follow up with a resource-hungry quantitative approach if our qualitative results suggest this level of effort is necessary. We use one tool to inform the decision of using the next tool and this works so long as we understand (and document) our assumptions.