Has your organization established formal criteria for when to use quantitative risk analysis methods, including defined probability and exposure formulas?

Quantitative risk analysis assigns numerical values to both the probability of security incidents and their potential impact, enabling more objective decision-making for resource allocation. Organizations should have clear guidelines specifying when quantitative methods are appropriate (versus qualitative approaches) and document the specific mathematical formulas used to calculate risk scores, probability distributions, and financial exposure values. Evidence could include a documented risk assessment methodology that outlines quantitative thresholds, formulas for calculating Annual Loss Expectancy (ALE), Single Loss Expectancy (SLE), probability values, and examples of completed quantitative risk assessments that demonstrate the application of these formulas.