Risks we face are uncertain EVENTS that matter. Matter in that if they occur, there will be a loss to one more more of the organization’s objectives.
Uncertain events that result in gains to the achievement of an organization’s objectives are sometimes called ‘upside risks’, but we prefer to refer to them as OPPORTUNITIES.
The expected loss from a risk event is the average loss over some period of time and is computed as the likelihood of the event times its impact.
The likelihood of an event can be estimated directly using a variety of measurement methods and based on historical data as well as human judgment.
The likelihood of an event can also be estimated indirectly by estimating the likelihood of one or more causes of the event and the likelihood of the event given its causes. Causes, sources, threats, intents, etc. may be certain or uncertain, but unlike events, do not result in a loss.