Difference between revisions of "Risk"
| Line 1: | Line 1: | ||
| ⚫ | |||
| ⚫ | '''Risk''' is a measure for the expectation of undesirable outcome ( |
||
| + | == Introduction == |
||
| ⚫ | '''Risk''' is a measure for the expectation of undesirable outcome (impact) to realise. This expectation concerns both the likelihood and magnitude of the undesired outcome. Quantified levels of risk are often used to enable an assessment of risk in order to establish if they fall within acceptable limits or to determine which risks pose the highest threat. |
||
| − | = Definitions = |
+ | == Definitions == |
| ⚫ | There is no one, universally accepted definition for risk. A prominent definition of risk is provided in the ISO 31000:2009 risk management standard where risk is defined as the ‘effect of uncertainty on objectives’ and both positive and negative effects are included. As this definition is of a high conceptual level and can be counter-intuitive, for the purpose of this wiki, the definition as mentioned in the introduction will be used. |
||
| ⚫ | |||
| ⚫ | There is no one, universally accepted definition for risk. A prominent definition of risk is provided in the ISO 31000:2009 risk management standard |
||
| ⚫ | |||
| + | Although terminology may vary, two widely accepted elements in the definition of risk are the inclusion of likelihood and magnitude and to a lesser extent, the fact that to arrive at a measure of risk, the two should be multiplied. |
||
| + | A simple, but widely used definition of risk is therefore |
||
| ⚫ | |||
| + | '''Risk''' = '''Likelihood''' of event realizing '''X''' '''Impact''' (expected loss in case the accident realizes). |
||
| ⚫ | |||
| − | + | Many variations exist, for example by distinguishing between the probability of a threat realizing (also called probability) and the probability that that threat will affect an object (vulnerability). An example would be storm damage: the probability would reflect the likelihood of a storm at the object, the vulnerability would reflect the likelihood that this storm would cause damage and the impact would reflect the extent of damage that would occur if the storm would cause damage. The quantified risk formula associated with this definition is |
|
| + | '''Risk''' = '''Likelihood''' of event realizing '''X''' '''vulnerability''' (probability of realized event impacting object) '''X''' '''Impact''' (expected loss in case the accident realizes and impacting object). |
||
| ⚫ | |||
| ⚫ | |||
| − | The use of probability relies on the ability to make reliable predictions. This is most often based on the analysis of past occurrences and identification of trends. When determining risk in the field of threats related to |
+ | The use of probability relies on the ability to make reliable predictions. This is most often based on the analysis of past occurrences and identification of trends. When determining risk in the field of threats related to human intent, the use of trend analysis to determine likelihood is criticised<ref name="ftn1"> Add reference |
| ⚫ | |||
| ⚫ | |||
| + | </ref> for threats actively seeking harm (for example terrorism). This is due to the fact that |
||
| − | A way to overcome these problems is to substitute [#_For_Human_intent ''attractivity''] for probability and [#_For_intentional_threats ''conceivability''] for vulnerability. In this way, assumptions about historical data predicting future events can be avoided. |
||
| ⚫ | |||
| ⚫ | |||
| ⚫ | |||
| − | |||
| − | t.b.d. |
||
| − | |||
| − | = Sources of risk = |
||
| − | One way to typify types of risk, is by their causes. A cause for risk is called a [#_Threat threat]. Threats can be classified into [#_Safety_1 safety] threats, consisting of [#_Natural_threats Natural threats], [#_Human_failure Human failure], [#_Technical_failure Technical failure], [#_Failure_of_critical Failure of Critical Services] and [#_Security security] threats which are due to [#_Human_intent Human Intent]. |
||
| − | = Related subjects = |
||
| + | ---- |
||
| − | t.b.d. |
||
| + | <references/> |
||
Revision as of 17:55, 28 February 2012
Contents
Risk
Introduction
Risk is a measure for the expectation of undesirable outcome (impact) to realise. This expectation concerns both the likelihood and magnitude of the undesired outcome. Quantified levels of risk are often used to enable an assessment of risk in order to establish if they fall within acceptable limits or to determine which risks pose the highest threat.
Definitions
There is no one, universally accepted definition for risk. A prominent definition of risk is provided in the ISO 31000:2009 risk management standard where risk is defined as the ‘effect of uncertainty on objectives’ and both positive and negative effects are included. As this definition is of a high conceptual level and can be counter-intuitive, for the purpose of this wiki, the definition as mentioned in the introduction will be used.
Objective and subjective risk
Risk assessment
Although terminology may vary, two widely accepted elements in the definition of risk are the inclusion of likelihood and magnitude and to a lesser extent, the fact that to arrive at a measure of risk, the two should be multiplied.
A simple, but widely used definition of risk is therefore
Risk = Likelihood of event realizing X Impact (expected loss in case the accident realizes).
Many variations exist, for example by distinguishing between the probability of a threat realizing (also called probability) and the probability that that threat will affect an object (vulnerability). An example would be storm damage: the probability would reflect the likelihood of a storm at the object, the vulnerability would reflect the likelihood that this storm would cause damage and the impact would reflect the extent of damage that would occur if the storm would cause damage. The quantified risk formula associated with this definition is
Risk = Likelihood of event realizing X vulnerability (probability of realized event impacting object) X Impact (expected loss in case the accident realizes and impacting object).
The estimation of likelihood in security
The use of probability relies on the ability to make reliable predictions. This is most often based on the analysis of past occurrences and identification of trends. When determining risk in the field of threats related to human intent, the use of trend analysis to determine likelihood is criticised[1] for threats actively seeking harm (for example terrorism). This is due to the fact that
- these events occur relatively infrequently, making the recognition of trends difficult;
- in contrast to for instance natural threats, the results of past events does influence the likelihood of future events: potential perpetrators will actively seek ‘the weakest link’. This means that the predicting value of trends in past occurrences is in doubt.
- ↑ Add reference
