Risk assessment is a process for identifying
hazards, potential (future) events which may negatively impact (harm) an individual(s), asset(s), and/or the environment likelihood (probability) of those hazards occurring consequences of those hazards actions (risk reduction methods) which can mitigate these hazardous effects.
As the first stage of a risk assessment process, hazard analysis identifies the situations and events for all potential or foreseeable hazards.
As part of the risk assessment process, judgments may be made "on the tolerability of the risk on the basis of a risk analysis" (i.e. risk evaluation taking into account costs and benefits of further risk reduction). Sometimes risks can be deemed tolerable, meaning the risk "is understood and tolerated .. usually because the cost or difficulty of implementing an effective countermeasure for the associated vulnerability exceeds the expectation of loss."
Results of a risk assessment process may be expressed in a quantitative or qualitative fashion.Hodge, N. (2021), "How to Address Low-Probability, High-Impact Risks", Risk Management
Risk assessment forms a key part of a broader risk management strategy to help reduce any potential risk-related consequences.
Rapid technological change, increasing scale of industrial complexes, increased system integration, market competition, and other factors have been shown to increase societal risk since the 90's. As such, risk assessments have become increasingly critical in mitigating accidents, improving safety, and improving outcomes.
More simply, risk assessment consists of an objective evaluation of risk in which assumptions and uncertainties are clearly considered and presented. More completely, risk assessments involve documentation of the risk assessment findings, implementation dates of mitigation methods, and periodic review of the risk assessment (or risk management plan), coupled with updates when necessary.
Categories Individual risk assessment
Risk assessments can be undertaken in individual cases, including in patient and physician interactions. In the narrow sense chemical risk assessment is the assessment of a health risk to an individual in response to environmental exposures.
Methods of communication of statistics to an individual, both through words and numbers impact an individual's interpretation of benefit and harm. For example, communicating to an individual a fatality rate may be interpreted as less benign than the corresponding survival rate. A 2017 systematic review of patients and doctors found that overstatement of benefits and understatement of risks occurred more often than the understatement/overstatement alternative. A 2024 systematic review from the Cochrane collaboration suggests "well-documented decision aids" help reduce effects of such tendency or bias. Decision aids may help individuals
come to a decision about their care based on evidence-informed information that aligns with their values. understand the risks more clearly take an active role when making medical decisions.
In people who had adverse treatment outcomes, the systematic review did not find a difference in decision regret between those who used decision aids and those who had the usual standard treatment without decision aids.
An individual's own risk perception may be affected by psychological, ideological, religious or otherwise subjective factors, which impact the rationality of the process. Individuals tend to be less rational when risks and exposures concern themselves as opposed to others. There is also a tendency to underestimate risks that are voluntary or where the individual sees themselves as being in control, such as smoking.
Systems risk assessment Risk assessment can also be made on a much larger systems theory scale, for example assessing the risks of an ecosystem or an interactively complex mechanical, electronic, nuclear, and biological system or a hurricane (a complex meteorological and geographical system). Systems may be defined as linear and nonlinear (or complex), where linear systems are predictable and relatively easy to understand given a change in input, and non-linear systems are unpredictable when inputs are changed. As such, risk assessments of non-linear/complex systems tend to be more challenging.
In the engineering of complex systems, sophisticated risk assessments are often made within safety engineering and reliability engineering when it concerns threats to life, natural environment, or machine functioning. The agriculture, nuclear, aerospace, oil, chemical, railroad, and military industries have a long history of dealing with risk assessment. Also, medical, hospital, social service, and food industries control risks and perform risk assessments on a continual basis. Methods for assessment of risk may differ between industries and whether it pertains to general financial decisions or environmental, ecological, or public health risk assessment.
Concept Mild versus wild risk Benoit Mandelbrot distinguished between "mild" and "wild" risk and argued that risk assessment and risk management must be fundamentally different for the two types of risk. Mild risk follows normal or near-normal probability distributions, is subject to regression to the mean and the law of large numbers, and is therefore relatively predictable. Wild risk follows fat-tailed distributions, e.g., Pareto or power-law distributions, is subject to regression to the tail (infinite mean or variance, rendering the law of large numbers invalid or ineffective), and is therefore difficult or impossible to predict. A common error in risk assessment and management is to underestimate the wildness of risk, assuming risk to be mild when in fact it is wild, which must be avoided if risk assessment and management are to be valid and reliable, according to Mandelbrot.
Mathematical conceptualization
To see the risk management process expressed mathematically, one can define expected risk as the sum over individual risks, , which can be computed as the product of potential losses, , and their probabilities, :
Even though for some risks , we might have , if the probability is small compared to , its estimation might be based only on a smaller number of prior events, and hence, more uncertain. On the other hand, since , must be larger than , so decisions based on this uncertainty would be more consequential, and hence, warrant a different approach.
This becomes important when we consider the variance of risk
as a large changes the value.
Financial decisions, such as insurance, express loss in terms of dollar amounts. When risk assessment is used for public health or environmental decisions, the loss can be quantified in a common metric such as a country's currency or some numerical measure of a location's quality of life. For public health and environmental decisions, the loss is simply a verbal description of the outcome, such as increased cancer incidence or incidence of birth defects. In that case, the "risk" is expressed as
If the risk estimate takes into account information on the number of individuals exposed, it is termed a "population risk" and is in units of expected increased cases per time period. If the risk estimate does not take into account the number of individuals exposed, it is termed an "individual risk" and is in units of incidence rate per time period. Population risks are of more use for cost/benefit analysis; individual risks are of more use for evaluating whether risks to individuals are "acceptable".
Quantitative risk assessment
In quantitative risk assessment, an annualized loss expectancy (ALE) may be used to justify the cost of implementing countermeasures to protect an asset. This may be calculated by multiplying the single loss expectancy (SLE), which is the loss of value based on a single security incident, with the annualized rate of occurrence (ARO), which is an estimate of how often a threat would be successful in exploiting a vulnerability.
The usefulness of quantitative risk assessment has been questioned, however. Barry Commoner, Brian Wynne and other critics have expressed concerns that risk assessment tends to be overly quantitative and reductive. For example, they argue that risk assessments ignore qualitative differences among risks. Some charge that assessments may drop out important non-quantifiable or inaccessible information, such as variations among the classes of people exposed to hazards, or social amplification. Furthermore, Commoner and O'Brien claim that quantitative approaches divert attention from precautionary or preventative measures. Others, like Nassim Nicholas Taleb consider risk managers little more than "blind users" of statistical tools and methods.
Risk engineering Risk engineering is central to the assessment phase, where risks are not only identified but rigorously analyzed, quantified, and modeled. In the context of financial systems—particularly credit risk—risk engineering involves understanding the dynamic behavior of risk parameters such as probability of default, exposure at default, and loss given default. These are not treated as isolated figures but as interconnected components that respond to systemic and idiosyncratic changes. As individual risks aggregate into portfolios or larger systems, risk engineers deploy statistical models and simulation techniques to uncover dependencies and potential cascade effects. This systems-level view enables the modeling of stress scenarios and rare, high-impact events—what some refer to as "wild risk." It also supports the design of robust structures capable of absorbing shocks and preventing systemic collapse. Regulatory frameworks add another layer to the assessment process, requiring that risk engineering efforts not only reflect real-world complexity but also align with institutional constraints.
Process Individual vs Organizational The process of risk assessment may be somewhat informal at the individual level, assessing economic and household risks, or a sophisticated, strategic process at the organization level. However, in both cases, the ability to anticipate future events and create effective strategies for mitigating them when deemed unacceptable is vital.
At the individual level, identifying objectives and risks, weighing their importance, and creating plans may be all that is necessary.
At the organization level, more elaborate, strategic policies may be necessary, specifying acceptable levels of risk (risk tolerance/company culture), standard procedures to be followed within the organization, priorities of risks to mitigate, and allocation of resources for such mitigation.
At the strategic corporate level, management involved with the project produces project-level risk assessments, with the assistance of available expertise, as part of the planning process and establishes systems to ensure that the required actions to mitigate the assessed risks are in place. At the dynamic level, personnel directly involved in implementing risk reduction methods may be required by the organization to address unforeseen hazards in real time. The tactical decisions made at this level should be reviewed after the operation to provide feedback on the effectiveness of both the planned procedures and the alternative decisions made in response to contingencies.
Circa 2013 and older textbooks distinguish between the terms risk analysis and risk evaluation. When risk analysis and risk evaluation are made at the same time, it is called risk assessment.
Medical Risk Analysis A risk analysis includes the following four steps: establish the context, which restricts the range (limits of use) of hazards to be considered. It is also necessary to identify the potential parties or assets which may be affected by the threat.