This case study by Laura Payne on 'Quantitative Risk Analysis & Information Security' does a very good job in explaining the journey of an organization like BMO, as it evolved from a 'High, Medium and Low' approach to measure and express risk to a more scientific and quantitative approach.
In this comprehensive video-presentation, she covers many foundational aspects of implementing quantitative risk analysis, including: