Risk is the possibility of something bad happening, comprising a level of uncertainty about the effects and implications of an activity, particularly negative and undesirable consequences.
Risk theory, assessment, and management are applied but substantially differ in different practice areas, such as business, economics, environment, finance, information technology, health, insurance, safety, security, and privacy. The international standard for risk management, ISO 31000, provides general guidelines and principles on managing risks faced by organizations.
Definition
The Oxford English Dictionary (OED) cites the earliest use of the word in English (in the spelling of risque from its French original, 'risque') as of 1621, and the spelling as risk from 1655. While including several other definitions, the OED 3rd edition defines risk as "(Exposure to) the possibility of loss, injury, or other adverse or unwelcome circumstance; a chance or situation involving such a possibility". The Cambridge Advanced Learner's Dictionary defines risk as "the possibility of something bad happening". Some have argued that the definition of risk is subjective and context-specific. The International Organization for Standardization (ISO) 31073 defines risk as:effect of uncertaintystate, even partial, of deficiency of information related to understanding or knowledge Note 1: In some cases, uncertainty can be related to the organization's context as well as to its objectives. Note 2: Uncertainty is the root source of risk, namely any kind of "deficiency of information" that matters in relation to objectives (and objectives, in turn, relate to all relevant interested parties' needs and expectations). on objectivesresult to be achieved Note 1: An objective can be strategic, tactical or operational. Note 2: Objectives can relate to different disciplines (such as financial, health and safety, and environmental goals) and can apply at different levels (such as strategic, organization-wide, project, product and process). Note 3: An objective can be expressed in other ways, e.g. as an intended outcome, a purpose, an operational criterion, as a management system objective, or by the use of other words with similar meaning (e.g. aim, goal, target). Note 1: An effect is a deviation from the expected. It can be positive, negative or both, and can address, create or result in opportunities and threats.potential source of danger, harm, or other undesirable outcome Note 1: A threat is a negative situation in which loss is likely and over which one has relatively little control. Note 2: A threat to one party may pose an opportunity to another.
Note 2: Objectives can have different aspects and categories, and can be applied at different levels.
Note 3: Risk is usually expressed in terms of risk sources, potential events, their consequences and their likelihood.
Other general definitions include:
"Source of harm" The earliest use of the word "risk" was as a synonym for the much older word "hazard", meaning a potential source of harm. This definition comes from Blount's "Glossographia" (1661) and was the main definition in the OED 1st (1914) and 2nd (1989) editions. Modern equivalents refer to "unwanted events"Hansson, Sven Ove, "Risk", The Stanford Encyclopedia of Philosophy (Fall 2018 Edition), Edward N. Zalta (ed.) or "something bad that might happen". "Chance of harm" This definition comes from Johnson's "Dictionary of the English Language" (1755), and has been widely paraphrased, including "possibility of loss" or "probability of unwanted events". "Uncertain events affecting objectives" This definition was adopted by the Association for Project Management (1997).A Guide to the Project Management Body of Knowledge (4th Edition) ANSI/PMI 99-001-2008 With slight rewording it became the definition in ISO Guide 73. "Uncertainty of outcome" This definition was adopted by the UK Cabinet Office (2002) to encourage innovation to improve public services. It allowed "risk" to describe either "positive opportunity or negative threat of actions and events". "Potential returns from an event ['a thing that happens or takes place'], where the returns are any changes, effects, consequences, and so on, of the event" This definition from Newsome (2014) expands the neutrality of 'risk' akin to the UK Cabinet Office (2002) and Knight (1921). "Human interaction with uncertainty" This definition comes from Cline (2015) in the context of adventure education.
Versus uncertainty In his seminal 1921 work Risk, Uncertainty, and Profit, Frank Knight established the distinction between risk and uncertainty.
Thus, Knightian uncertainty is immeasurable, not possible to calculate, while in the Knightian sense risk is measurable.
By field +Definitions of riskFieldDefinitionSourcesRelated conceptsEconomicsUncertainty about lossWillett's "Economic Theory of Risk and Insurance" (1901).InsuranceMeasurable uncertaintyKnight's "Risk, Uncertainty and Profit" (1921).Knightian uncertainty, mortality risk, longevity risk, interest rate riskPossibility of an event occurring which causes injury or lossLloyd's.FinanceVolatility of returnMarkovitz's "Portfolio Selection" (1952).Financial risk management, Risk aversionComponents: Downside risk, Upside risk, Inherent risk, Benefit riskBusiness risks: Enterprise risk management, Audit risk, Process risk, Legal risk, Reputational risk, Peren–Clement indexInvestments: Modern portfolio theory, Value at risk, HedgeTypes of financial risks: Market risk, Credit risk, Liquidity risk, Operational riskDecision theoryStatistically expected lossWald (1939). Used in planning of Delta Works in 1953.Wired Magazine, Before the levees break, page 3. Adopted by the US Nuclear Regulatory Commission in 1975. Remains widely used.Bayesian analysisScenarios, probabilities and consequences: Consequences and associated uncertainty; likelihood and severity of eventsKaplan & Garrick (1981). Found in ISO Guide 73 Note 4.Occupational health and safetyCombination of the likelihood and consequence(s) of a specified hazardous event occurringOccupational Health and Safety Assessment Series (OHSAS) standard OHSAS 18001, 1999.Occupational hazard, High reliability organisation, Probabilistic risk assessment, WASH-1400Ranking of Risks for Existing and New Building Works, Sustainability 2019, 11(10), 2863, https://doi.org/10.3390/su11102863CybersecurityAsset, threat and vulnerabilityThreat Analysis Group (2010).Information security, IT risk management, IT riskEnvironmentChance of harmful effects to human health or to ecological systemsUnited States Environmental Protection Agency.Environmental hazards, Environmental issues, Environmental protectionHealthPossibility that something will cause harmCentres for Disease Control and Prevention.Epidemiology, Risk factors, Health risk assessment, Relative risk, Mortality rate, Loss of life expectancyProject managementAn uncertain event or condition that, if it occurs, has a positive or negative effect on a project's objectivesProject Management Institute.Boroomand, A. and Smaldino, P.E., 2021. Hard Work, Risk-Taking, and Diversity in a Model of Collective Problem Solving. Journal of Artificial Societies and Social Simulation, 24(4).Project risk managementSecurityAny event that could result in the compromise of organizational assets i.e. the unauthorized use, loss, damage, disclosure or modification of organizational assets for the profit, personal interest or political interests of individuals, groups or other entitiesJulian Talbot and Miles Jakeman Security Risk Management Body of Knowledge, John Wiley & Sons, 2009.Security managementMachineryProbability of occurrence and severity of harmFunctional Safety
Mathematical
Triplets Risk is often considered to be a set of triplets
for i = 1,2,....,N
where: is a scenario describing a possible event is the probability of the scenario is the consequence of the scenario is the number of scenarios chosen to describe the risk
Risks expressed in this way can be shown in a risk register or a risk matrix. They may be quantitative or qualitative, and can include positive as well as negative consequences.
An updated version recommends the following general description of risk:
where: is an event that might occur is the consequences of the event is an assessment of uncertainties is a knowledge-based probability of the event is the background knowledge that U and P are based on
Probability distributions If all the consequences are expressed in the same units (or can be converted into a consistent loss function), the risk can be expressed as a probability density function describing the uncertainty about outcome:
This can also be expressed as a cumulative distribution function (CDF) (or S curve). One way of highlighting the tail of this distribution is by showing the probability of exceeding given losses, known as a complementary cumulative distribution function, plotted on logarithmic scales. For example, frequency-number diagrams show the annual frequency of exceeding given numbers of fatalities. Another way of summarizing the size of the distribution's tail is the loss with a certain probability of exceedance, that is, the value at risk.
Expected values Risk is often measured as the expected value of the loss. This combines the probabilities and consequences into a single value. See also expected utility. The simplest case is a binary possibility of Accident or No accident. The associated formula for calculating risk is then:
In a situation with several possible accident scenarios, total risk is the sum of the risks for each scenario, provided that the outcomes are comparable:
In statistical decision theory, the risk function is defined as the expected value of a given loss function as a function of the decision rule used to make decisions in the face of uncertainty.
A disadvantage of defining risk as the product of impact and probability is that it presumes, unrealistically, that decision-makers are risk-neutral. A risk-neutral person's utility is proportional to the expected value of the payoff. For example, a risk-neutral person would consider 20% chance of winning $1 million exactly as desirable as getting a certain $200,000. However, most decision-makers are not actually risk-neutral and would not consider these equivalent choices. Pascal's mugging is a philosophical thought experiment that demonstrates issues in assessing risk solely by the expected value of loss or return.
Outcome frequencies Risks of discrete events such as accidents are often measured as outcome frequencies, or expected rates of specific loss events per unit time. When small, frequencies are numerically similar to probabilities, but have dimensions of and can sum to more than 1. Typical outcomes expressed this way include:
Individual risk - the frequency of a given level of harm to an individual. It often refers to the expected annual probability of death, and is then comparable to the mortality rate. Group (or societal risk) – the relationship between the frequency and the number of people suffering harm. Frequencies of property damage or total loss. Frequencies of environmental damage such as oil spills.
Financial risk
In finance, an elementary measure of risk for financial asset prices is with volatility, the degree of variation of a trading price over time, usually measured by the standard deviation of logarithmic returns.
Portfolio theory Modern portfolio theory measures the riskiness of a portfolio using the variance (or standard deviation) of the portfolio. If we denote return by of a portfolio with weight vector then the risk, as measured by variance of the portfolio is given by