Quantitative v qualitative risk analysis