The risk is assessed as high. So what?
While there may be a debate whether risk should be assessed using qualitative or quantitative measures, I believe that is answering the wrong question. Knowing what the level of risk is, even whether it is an unacceptable level of risk, is insufficient information.
