Qualitative vs. Quantative Risk Assessment