A collaborative process of assigning relative values to assets, assessing their risk exposure, and estimating the cost of controlling the risk. Differs from quantitative risk analysis in that it utilizes relative measures and approximate costs rather than precise valuation and cost determination.