Risk analysis or its quantification, commonly known as RA and QRA, is the process of
defining and analyzing the dangers to individuals, businesses and government agencies
posed by potential natural and human-caused adverse events. A risk analysis report
can be either quantitative or qualitative.
In quantitative risk analysis, an attempt is made to numerically determine the
probabilities of various adverse events and the likely extent of the losses if a particular
event takes place.
Qualitative risk analysis, which is used more often, does not involve numerical
probabilities or predictions of loss. Instead, the qualitative method involves defining the
various threats, determining the extent of vulnerabilities and devising countermeasures
should an attack occur.