Category qualitative vs quantitative risk analysis