This study presents a quantifying risk management process and its application on a software organization in terms of risk items mitigated, exposures covered, costs, and expected exposures covered. Risk management is defined as setting forth a discipline and environment of proactive decisions and actions to assess continuously what can go wrong (risks), to determine what risks are important to deal with, and to implement strategies to deal with those risks. Risk management can be applied in all of the business areas. In the literature, there are sources for risk management. Some of them are qualitative, and some of them are quantitative. However, there is no much source about the application study of a quantifying risk management process on a software organization. In order to obtain insight about this issue, this study presents a quantifying risk management system to the literature and also compares the quantifying risk management policies on the data set of a software organization by finding out and analyzing their performance with respect to designated decision parameters and preference profiles for risk items mitigated, exposures covered, costs, and expected exposures covered. At the end of this study, suitable quantifying risk management policies for each profile are recommended by considering the analysis of the data set as base.