Many authors refer to risk as the probability of loss multiplied by the amount of loss (in monetary terms). Is this right, or at least acceptable, as a definition of risk?
The formulation "risk = probability (of a disruption event) x loss (connected to the event occurrence)" is a measure of the expected loss connected with something (i.e., a process, a production activity, an investment...) subject to the occurrence of the considered disruption event. It is a way to quantify risks.
You may also rephrase as "risk = failure probability x damage related to the failure".
For example, assume you have to choose between 2 different investments A and B: A is subject to a disrupting event with probability 0.01 with a related loss of 1000, while B is subject to a disrupting event with probability 0.02 with a loss of 800. Calculating the risk with the formula, you have:
Risk(A) = 0.01 x 1000 = 10
Risk(B) = 0.02 x 800 = 16
So, if you are risk averse, you may prefer A over B.
This formula is also used (with a further term related to the possibility to detect the disruption, or failure as it is called) in the Failure modes and effects analysis (FMEA).
this definition is the one used by classical insurance companies. It assumes that the theoretical assumptions: you know the probabiiities, you can use the law of large numbers and insurance contracts are mutualized (you don't pay your risk premium but the average premium obtained (at the limit) by the law of large numbers with variance converging to 0. It cannot be applied to catastrophic risks, for instance, or if the insurance company mixes up classes of risks that differ (in probability or in the type of losses).
The classic definition of risk is the probability of occurrence of an unwanted event multiplied by the consequence (loss) of the event. There are three types of loss: people, property and efficacy.
In the US the Department of Homeland security defines risk as the potential for an unwanted outcome resulting from an incident, event, or occurrence, as
determined by its likelihood and the associated consequences.
Risk is the expected loss resulting from a threat exploiting a vulnerability existing in organisation. Risk management process is continous with options of acceptance, avoidance, transference and mitigation.
Risk (r) = Hazard probability (H) x Vulnerability (V) of an element
Risk Management = H xV / m
where m is the management. Risk Management is the systematic application of management policies, procedures, and practices to the tasks of establishing the context, identifying, analyzing, assessing, mitigating, monitoring and communicating
In risk management, vulnerability is the result of intrinsic properties of something that create susceptibility to a hazard. In physics this definition is merely associated to the definition of sensitivity. From a large series of similar events most of them do not result in serious harm while some of them lead to major harm (incident pyramid of Heinrich).
The probability that harm occurs once a threat is present can also be determined by bad luck due to external factors (e.g., weak spot in the organization, extremely aggressive environment).Kasili, what is your meaning of vulnerability?
Kasili, what do you mean with the variable m? Is it the adaptability of an organization, the degree to which an organization is able to perform adjustments.
m - management preventive, mitigation, preparedness, response, recovery, and resiliency . You can see that if m approaches zero the destruction risk tends to infinity?
From the epidemiological point of view, risk (R) is the expected status following an environmental health-related situation, i.e. R = the probability of a hazard (H) (ex. a specific infection) * the element at risk (E) (ex. a resident population) * vulnerability (V) (the state of that population, ex. with respect to nutrition, immunity, etc.).
Risk (r) = Hazard probability (H) x Vulnerability (V) of an element
Risk Management = H xV / m
where m is the management. Risk Management is the systematic application of management policies, procedures, and practices to the tasks of establishing the context, identifying, analyzing, assessing, mitigating, monitoring and communicating. M are measures taken prior to, during, & after disastrous event: management preventive, mitigation, preparedness, response, recovery, and resiliency . You can see that if M approaches zero the destruction risk tends to infinity (Calamitous)?
It could be right, but the problem will be moved from the definition of risk to the monetary loss definition, since it could be very difficult to translate a politcal or a environmental risk.
In Colombia, in general en Latina América, two equations are used (Risk Disasters):
A * V = R (Amenaza multiplicada por la vulnerabilidad es igual al riesgo)
H * V = R (Hazard multiplied by Vulnerability equal to risk.
The multiplicative factor (*) is used because it is considered that any of the two factors (A or V, H or V) are zero, the result will be zero.
Threat and vulnerability are codependent.
Today the "H + V = R." is not used.
Ultimately the equation is used
Rf: (A, V, E), that is, that the risk is based on three factors, threat, vulnerability and risk, being also codependent, and not necessarily in a multiplication, but in any type of equation that indicates that Any of the three that is zero, the risk will be zero.
However, to be more specific, "Time" and "Space" should be considered as the factors of Hazard(H). Hence, to calculate a specific risk (RS), the above equation can be modified as follows:
RS = P (T:Hs) * P (L:Hs) * V(Es | Hs ) * AES
in which:
P (T:Hs) is the temporal (e.g. annual) probability of occurrence of a specific hazard scenario (Hs) with a given return period in an area;
P (L:Hs) is the spatial (e.g. location) probability of occurrence of a specific HS with a given return period in an area impacting the elements-at-risk;
V(Es | Hs ) is the physical vulnerability, specified as the degree of damage to a specific element-at-risk Es given the local intensity caused due to the occurrence of hazard scenario HS;
AEs is the quantification of the specific type of element at risk evaluated (e.g. number of buildings).
Thus, Management strategies (M) such as "Control", "Mitigation", or etc., can be denoted as the "Capacity" or "Margin of maneuver" or etc., and added to the above basic equation to form the "Risk Management" (RM) as follow:
RM= H*V*A/M
For additional reading I suggest to read about the concept of "carrying capacity" as it's illustrated by the J-shaped graph of exponential population growth (https://en.wikipedia.org/wiki/Carrying_capacity). This concept can shed a light on understanding risk from the Systems perspective (i.e., ecosystem), particularly for those in the field of Environmental Risk Management.
Simply, invest in management, factor pre-disaster and post disaster measures in social-economic development planning and implementation focusing vulnerability and risk reduction.
Risk goes beyond the product of likelihood and impact - a definition that merely reflects the stochastic expectation value.
Risk is more about knowing how to work towards reduction of uncertainty. If your experience tells you that a (risky) event is about to re-occur in the near-future then you will take precautions to mitigate the impact of that (loss) event. Such actions are called controls. Hence, the risk formula to factor their influence into account will be the product of three factors: likelihood, impact and control effectiveness.
: Risk quantification does not end at assigning probabilities to identified risk and subsequently ranking them. Risk tends to have complex internal causal relationships. Two dependent risks may cascade. And, as you point out, there is an objective that the risk will have an effect upon (The Project).