https://staragile.com/blog/qualitative-and-quantitative-risk-analysis