Business impact can be calculated using either a qualitative or a quantitative approach. Qualitative analysis depends on the experience of employees and consultants to arrive at risk scores.