Howdy,

I just published the latest entry to my Visible IT blog titled “The Beauty of Guesstimates: Qualitative Assessments in Quantified Terms.”

Here’s a teaser:

The COSO ERM – Integrated Framework document makes this assertion:

“An entity’s risk assessment methodology comprises a combination of qualitative and quantitative techniques. Management often uses qualitative assessment techniques where risks do not lend themselves to quantification or when either sufficient credible data required for quantitative assessments is not practically available or obtaining or analyzing data is not cost-effective. Quantitative techniques typically bring more precision and are used in more complex and sophisticated activities to supplement qualitative techniques.” from COSO ERM – Integrated Framework

This statement would seem to imply that risk assessments based on quantification are preferable and more subjective, qualitative methods should only be used when the data that goes into quantification models is not “credible” or when the cost of obtaining the data is too high.

Maybe for enterprise risk management this is a reasonable approach, but not in the real of IT Governance because there are just too many important considerations in an IT organization that can’t be quantified readily. That’s why the Einstein quote kept coming back to me…….

As always, I welcome your feedback either here or on the original blog entry.