---
sourceDocument: Yokohama Governance, Risk, and Compliance
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/governance-risk-compliance

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Types of risk rating methodologies

# Types of risk rating methodologies {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Risks are scored during an assessment and then a rating is derived. Ratings are of three
kinds: qualitative, semi-quantitative, and quantitative.

## Qualitative rating {#qual-vs-quant__section_jn3_5vb_h4b}

Qualitative risk assessments rely on the assessor's perceptions of the probability and impact
of a risk. If the method is purely qualitative, then the ratings are based on the list values
such as high, medium, or low. In this case, the risk scores do not roll up. Because this method
has minimal mathematical dependency, qualitative risk assessment is easy and quick to perform.
This method also enables an organization to take advantage of the assessor's experienced
knowledge of the process or asset that is being assessed. Users who are new to risk assessments
usually use this kind of rating.  
The following figure shows an example of qualitative rating.Figure 1. Qualitative risk assessment

## Semi-quantitative rating {#qual-vs-quant__section_w3r_2xb_h4b}

In a semi-quantitative rating, the qualitative ratings also have a corresponding numerical
scale. For example, if the quantitative risk score is between 0-10, then the qualitative rating
is low. Users who use this type of rating are not new to risk assessments. Most users belong to
this category. In this category, the risk scores roll up and the risk appetite is qualitative in
nature.  
The following figure shows an example of semi-quantitative rating.Figure 2. Semi-quantitative risk rating

## Quantitative rating {#qual-vs-quant__section_ep5_qxb_h4b}

A quantitative risk assessment focuses on data that is fact-based, measurable, and highly
mathematical. In a quantitative risk rating that uses advanced simulation techniques, the risk
is quantified in purely numerical terms. In this category, the risk appetite is quantitative in
nature.
* **[Transformation criteria](https://servicenow-prod.fluidtopics.net/TCzxOY4gA1d9xhF2sn3i~A)**   
  After the risk scores are calculated, you can transform the scores into a rating and then easily report the ratings to senior management and to other stakeholders.