There are various models and methods for assessing risk, and the extent of an analysis and the resources expended can vary depending on the scope of the assessment and the availability of reliable data on risk factors. In addition, the availability of data can affect the extent to which risk assessment results can be reliably quantified.

A quantitative approach generally estimates the monetary cost of risk and risk reduction techniques based on

1. The likelihood that a damaging event will occur,
2. The costs of potential losses, and
3. The costs of mitigating actions that could be taken.

When reliable data on likelihood and costs are not available, a qualitative approach can be taken by defining risk in more subjective and general terms such as high, medium, and low. In this regard, qualitative assessments depend more on the expertise, experience, and judgement of those conducting the assessment. It is also possible to use a combination of quantitative and qualitative methods.