How do you assess risk using a qualitative matrix?

• A. Rate likelihood and severity on a matrix to determine risk level, then apply controls accordingly.
• B. Base risk solely on past incidents.
• C. Assess only the financial impact of controls.
• D. Use a binary risk yes/no without gradation.

Answer: (C)

Assessing risk with a qualitative matrix means rating two dimensions—how likely the hazard is to happen and how severe the consequences would be—then placing that combination on a matrix to yield a risk level (such as low, medium, or high). This setup lets you compare different hazards on the same scale and decide which controls to implement based on how high the risk is. It relies on more than just past incidents; past data helps shape the likelihood and severity estimates, but you also consider current conditions and exposure to determine the best actions. It's also broader than just financial impact, capturing health, environmental, and operational consequences. Because risk is shown with gradations rather than a simple yes/no, you can prioritize resources and tailor controls to the severity and probability of each hazard.