According to ISO 22301 Lead Auditor objectives and content, a qualitative approach is a type of approach that has a straightforward process based on informed judgement supported by appropriate guidance. A qualitative approach is used to assess the impacts and risks of a disruption to the organization’s processes, resources, and objectives. A qualitative approach relies on the subjective evaluation of the likelihood and severity of the disruption, as well as the effectiveness of the existing controls and mitigation measures. A qualitative approach can use descriptive scales, such as low, medium, and high, to rank the impacts and risks. A qualitative approach can also use tools, such as matrices, diagrams, and checklists, to facilitate the analysis and communication of the results. A qualitative approach is suitable for organizations that have limited data, resources, or time to conduct a quantitative approach, which requires more complex and objective calculations and measurements. References: ISO 22301 Auditing eBook, page 401; ISO 22301 Clause 8.2.2 Risk assessment2