Quantitative and qualitive assessment are both needed when analyzing risks. Both
collect data that can be used to help make decisions.
Quantitative assessments use actual numbers and is more direct, and straight to the
point. It includes formulas and equations.
Qualitative assessments go into a little more details with the information collected,
breaking down the type of information collected to get a more rounded picture.
For example, my sorority requires dues, fees and other payments to be made
annually. The systems used to collect payments change over time. I'm quite sure
that both quantitative and qualitative assessments were used to determine the next
phase of enhancements. The quantitative information would consist of how much is
paid per local, state, regional and national levels, the qualitative information would be
expressed with information showing a breakdown of method of payment, payment
source, etc.
Qualitative would be better to determine IT risks because more data can be collected
over time, notes and results can be compared and used to plan accordingly. Surveys
are sent out to touch base with the body and to get feedback real time.
