Firefighters are exposed to risks offire and building collapse during their work.
Risk is the possibility of something bad happening,[1] comprising a level ofuncertainty about the effects and implications of an activity, particularly negative and undesirable consequences.[2][3]
Harbor sign warning visitors that use of the walkway is "at your own risk"
This section needs to beupdated. The reason given is: ISO 31000. Please help update this article to reflect recent events or newly available information.(September 2025)
TheOxford English Dictionary (OED) cites the earliest use of the word in English (in the spelling ofrisque from its French original, 'risque') as of 1621, and the spelling asrisk from 1655. While including several other definitions, the OED 3rd edition definesrisk as "(Exposure to) the possibility of loss, injury, or other adverse or unwelcome circumstance; a chance or situation involving such a possibility".[5] TheCambridge Advanced Learner's Dictionary defines risk as "the possibility of something bad happening".[1] Some have argued that the definition of risk is subjective and context-specific.[2][6] TheInternational Organization for Standardization (ISO) 31073 defines risk as:[7][8]
Note 1: An effect is a deviation from the expected. It can be positive, negative or both, and can address, create or result in opportunities andthreats.[11]
Note 2: Objectives can have different aspects and categories, and can be applied at different levels.
Note 3: Risk is usually expressed in terms of risk sources, potential events, their consequences and their likelihood.
Other general definitions include:
"Source of harm". The earliest use of the word "risk" was as a synonym for the much older word "hazard", meaning a potential source of harm. This definition comes from Blount's "Glossographia" (1661)[12] and was the main definition in the OED 1st (1914) and 2nd (1989) editions. Modern equivalents refer to "unwanted events"[13] or "something bad that might happen".[1]
"Chance of harm". This definition comes from Johnson's "Dictionary of the English Language" (1755), and has been widely paraphrased, including "possibility of loss"[5] or "probability of unwanted events".[13]
"Uncertain events affecting objectives". This definition was adopted by the Association for Project Management (1997).[14][15] With slight rewording it became the definition in ISO Guide 73.[3]
"Uncertainty of outcome". This definition was adopted by the UK Cabinet Office (2002)[16] to encourage innovation to improve public services. It allowed "risk" to describe either "positive opportunity or negative threat of actions and events".
"Potential returns from an event ['a thing that happens or takes place'], where the returns are any changes, effects, consequences, and so on, of the event". This definition from Newsome (2014) expands the neutrality of 'risk' akin to the UK Cabinet Office (2002) and Knight (1921).[17]
"Human interaction with uncertainty". This definition comes from Cline (2015) in the context of adventure education.[18]
In his seminal 1921 workRisk, Uncertainty, and Profit,Frank Knight established the distinction between risk and uncertainty.
... Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. The term "risk," as loosely used in everyday speech and in economic discussion, really covers two things which, functionally at least, in their causal relations to the phenomena of economic organization, are categorically different. ... The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomenon depending on which of the two is really present and operating. ... It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an unmeasurable one that it is not in effect an uncertainty at all. We ... accordingly restrict the term "uncertainty" to cases of the non-quantitive type.[19]
Thus,Knightian uncertainty is immeasurable, not possible to calculate, while in the Knightian sense risk is measurable.
Any event that could result in the compromise of organizational assets i.e. the unauthorized use, loss, damage, disclosure or modification of organizational assets for the profit, personal interest or political interests of individuals, groups or other entities
Risk is often considered to be a set of triplets[31][26]
for i = 1,2,....,N
where:
is a scenario describing a possible event
is the probability of the scenario
is the consequence of the scenario
is the number of scenarios chosen to describe the risk
Risks expressed in this way can be shown in arisk register or arisk matrix. They may be quantitative or qualitative, and can include positive as well as negative consequences.[40]
An updated version recommends the following general description of risk:[30]
where:
is an event that might occur
is the consequences of the event
is an assessment of uncertainties
is a knowledge-based probability of the event
is the background knowledge that U and P are based on
If all the consequences are expressed in the same units (or can be converted into a consistentloss function), the risk can be expressed as aprobability density function describing the uncertainty about outcome:
This can also be expressed as acumulative distribution function (CDF) (or S curve).[40] One way of highlighting the tail of this distribution is by showing the probability of exceeding given losses, known as acomplementary cumulative distribution function, plotted on logarithmic scales. For example, frequency-number diagrams show the annual frequency of exceeding given numbers of fatalities.[40] Another way of summarizing the size of the distribution's tail is the loss with a certain probability of exceedance, that is, thevalue at risk.
Risk is often measured as theexpected value of the loss. This combines the probabilities and consequences into a single value. See alsoexpected utility. The simplest case is a binary possibility ofAccident orNo accident. The associated formula for calculating risk is then:
In a situation with several possible accident scenarios, total risk is the sum of the risks for each scenario, provided that the outcomes are comparable:
In statistical decision theory, therisk function is defined as the expected value of a givenloss function as a function of thedecision rule used to make decisions in the face of uncertainty.
A disadvantage of defining risk as the product of impact and probability is that it presumes, unrealistically, that decision-makers arerisk-neutral. A risk-neutral person's utility is proportional to theexpected value of the payoff. For example, a risk-neutral person would consider 20% chance of winning $1 million exactly as desirable as getting a certain $200,000. However, most decision-makers are not actually risk-neutral and would not consider these equivalent choices.[26]Pascal's mugging is a philosophical thought experiment that demonstrates issues in assessing risk solely by the expected value of loss or return.
Risks of discrete events such as accidents are often measured as outcomefrequencies, or expected rates of specific loss events per unit time. When small, frequencies are numerically similar to probabilities, but have dimensions of1/t and can sum to more than 1. Typical outcomes expressed this way include:[41]
Individual risk - the frequency of a given level of harm to an individual.[42] It often refers to the expected annual probability of death, and is then comparable to themortality rate.
Group (or societal risk) – the relationship between the frequency and the number of people suffering harm.[42]
Frequencies of property damage or total loss.
Frequencies of environmental damage such as oil spills.
Infinance,volatility is the degree of variation of a trading price over time, usually measured by the standard deviation of logarithmic returns.Modern portfolio theory measures risk using thevariance (or standard deviation) of asset prices. The risk is then:
Thebeta coefficient measures the volatility of an individual asset to overall market changes. This is the asset's contribution tosystematic risk, which cannot be eliminated by portfolio diversification. It is thecovariance between the asset's return ri and the market return rm, expressed as a fraction of the market variance:[43]
Let be a d-dimensional market representing the price processes of the risky assets, the risk-free bond andthe underlying probability space. Then a measure is a risk-neutral measure if
Benoit Mandelbrot distinguished between "mild" and "wild" risk and argued that risk assessment and analysis must be fundamentally different for the two types of risk.[45] Mild risk followsnormal or near-normalprobability distributions, is subject toregression to the mean and thelaw of large numbers, and is therefore relatively predictable. Wild risk followsfat-tailed distributions, e.g.,Pareto orpower-law distributions, is subject to regression to the tail (infinite mean or variance, rendering the law of large numbers invalid or ineffective), and is therefore difficult or impossible to predict. A common error in risk assessment and analysis is to underestimate the wildness of risk, assuming risk to be mild when in fact it is wild, which must be avoided if risk assessment and analysis are to be valid and reliable, according to Mandelbrot.
Risk management is the set of actions that organisations take to avoid and mitigatedownside risks,[46][3] taking into account factors such as the possibility ofupside risk opportunities,[47] innovation,[48] the environment, safety,[49] scientific evidence, culture, politics, and law.[46] Risk management operates at the strategic, operational, and individual level,[4] and may form part of an overarchinggovernance, risk, and compliance strategy. It comprises the assessment of risk as regards an organisation's objectives and strategies, as well as riskmitigation options, such as risk transformation, risk transfer, risk avoidance, risk reduction, and risk retention.[50]
Risk assessment is a systematic approach to recognising and characterising risks, and evaluating their significance, in order to support decisions about how to manage them.ISO 31000 defines it in terms of its components as "the overall process of risk identification, risk analysis and risk evaluation":[4]
Risk identification is "the process of finding, recognizing and recording risks". It "involves the identification of risk sources, events, their causes and their potential consequences."[3]ISO 31000 describes it as the first step in a risk assessment process, preceding risk analysis and risk evaluation.[4] In safety contexts, where risk sources are known as hazards, this step is known as "hazard identification".[51]
The ISO definesrisk analysis as "the process to comprehend the nature of risk and to determine the level of risk".[3] In the ISO 31000 risk assessment process, risk analysis follows risk identification and precedes risk evaluation.[40] Risk analysis often uses data on the probabilities and consequences of previous events.
Risk evaluation involves comparing estimated levels of risk against risk criteria to determine the significance of the risk and make decisions about risk treatment actions.[40] In most activities, risks can be reduced by adding further controls or other treatment options, but typically this increases cost or inconvenience. It is rarely possible to eliminate risks altogether without discontinuing the activity. Sometimes it is desirable to increase risks to secure valued benefits. Risk criteria are intended to guide decisions on these issues.[52]
For example, the tolerability of risk framework, developed by the UKHealth and Safety Executive, divides risks into three bands:[53]
Unacceptable risks – only permitted in exceptional circumstances.
Tolerable risks – to be kept as low as reasonably practicable (ALARP), taking into account the costs and benefits of further risk reduction.
Broadly acceptable risks – not normally requiring further reduction.
The termsrisk appetite, attitude, and tolerance are often used similarly to describe an organisation's or individual's attitude towards risk-taking. One's attitude may be described asrisk-averse,risk-neutral, orrisk-seeking.[54]
Risk perception is the subjective judgement that people make about the characteristics and severity of a risk. At its most basic, the perception of risk is an intuitive form of risk analysis.[57]
Adults have an intuitive understanding of risk, which may not be exclusive to humans.[58] Many ancient societies believed in divinely determinedfates, and attempts to influence the gods can be seen as early forms of risk management. Early uses of the word 'risk' coincided with an erosion of belief in divinely ordained fate.[59] Notwithstanding, intuitive perceptions of risk are often inaccurate owing to reliance onpsychological heuristics, which are subject to systematiccognitive biases.[60] In particular, the accuracy of risk perception can be adversely affected by theaffect heuristic, which relies on emotion to make decisions.[61][62]
Theavailability heuristic is the process of judging the probability of an event by the ease with which instances come to mind. In general, rare but dramatic causes of death are over-estimated while common unspectacular causes are under-estimated;[63] an "availability cascade" is a self-reinforcing cycle in which public concern about relatively minor events is amplified by media coverage until the issue becomes politically important.[64] Despite the difficulty of thinking statistically, people are typically subject to theoverconfidence effect in their judgements, tending to overestimate their understanding of the world and underestimate the role of chance,[65] with even experts subject to this effect.[66] Other biases that affect the perception of risk includeambiguity aversion.
Paul Slovic's "psychometric paradigm" assumes that risk is subjectively defined by individuals, influenced by factors such as lack of control, catastrophic potential, and severity of consequences, such that risk perception can be psychometrically measured by surveys.[67][68][69] Slovic argues that intuitive emotional reactions are the predominant method by which humans evaluate risk, and that a purely statistical approach to disasters lacks emotion and thus fails to convey the true meaning of disasters and fails to motivate proper action to prevent them.[70] This theory has received support fromretrospective studies and evolutionary psychology.[71][72][73][74][75][76] Hazards with high perceived risk are therefore, in general, seen as less acceptable and more in need of reduction.[77]
Cultural theory of risk views risk perception as a collective phenomenon by which different cultures select some risks for attention and ignore others, with the aim of maintaining their particular way of life.[78] Hence risk perception varies according to the preoccupations of the culture. The theory outlines two categories, the degree of binding to social groups, the degree of social regulation.[79] Cultural theory can be used to explain why it can be difficult for people with different world-views to agree about whether a hazard is acceptable, and why risk assessments may be more persuasive for some people than others. However, there is little quantitative evidence that showscultural biases are strongly predictive of risk perception.[80]
Indecision theory, regret (and anticipation of regret) can play a significant part in decision-making, distinct fromrisk aversion.[81][82]Framing is also a fundamental problem with all forms of risk assessment.[83] In particular, because ofbounded rationality, the risk of extreme events is discounted because the probability is too low to evaluate intuitively. As an example, one of the leading causes of death isroad accidents caused bydrunk driving – partly because any given driver frames the problem by largely or totally ignoring the risk of a serious or fatal accident. The rightprefrontal cortex has been shown to take a more global perspective,[84] while greater left prefrontal activity relates to local or focal processing.[85][86][87]Reference class forecasting is a forecasting method by which biases associated with risks can be mitigated.
Psychologists have run randomised experiments with a treatment and control group to ascertain the effect of different psychological factors that may be associated withrisk taking,[88] finding that positive and negative feedback about past risk taking can affect future risk taking. For example, one experiment showed that belief in competence correlated with risk-taking behavior.[89]Risk compensation is atheory that suggests that people typically adjust theirbehavior in response to the perceived level of risk, becoming more careful where they sense greater risk and less careful if they feel more protected.[90] People also showrisk aversion, such that they reject fair risky offers because of theperception of loss.[91][92] Further, intuitive responses have been found to be less risk-averse than subsequent reflective response.[93]
Sex differences in financial decision making are relevant and significant. Numerous studies have found that women tend to be financially more risk-averse than men and hold saferportfolios.[94][95] Scholarly research has documented systematic differences in financial decisions such as buying investments versus insurance, donating to ingroups versus outgroups (such as terrorism victims in Iraq versus the United States), spending in stores,[96] and the endowment effect-or asking price for goods people have.[97]
Peter L. Bernstein (2012) showed that people used risk estimates before statistics and probability calculations were developed. Instead of relying on numbers, people used narratives and letters.[98] Captains and merchants shared voyage stories at coffeehouses, comparing notes about hazards on new routes and seasonal patterns. Through a web of correspondents, letters became increasingly important as people could update their beliefs about weather, wars, or piracy over long distances. These qualitative data helped investors and underwriters judge how dicey a proposed voyage felt.
This kind of evidence has led philosophers to think there is more to (objective) risk than the likelihood of an undesirable outcome. Ebert et al. (2020) suggest distinguishing risk monists from risk pluralists:[99] risk monists argue that there is just one correct way to understand risk. Tversky and Kahneman can be considered monists in this sense; probability judgments that diverged from the probability calculus were deemed wrong or biased.[100] By contrast, pluralists claim that there are different, valid notions of risk. On this view, people who lived before statistics were developed may have been doing something legitimate when they estimated risks—even if those estimates conflict with a statistical notion. Without statistics, what else could they have done?
According to the modal account of risk, a situation is risky when nearbypossible worlds—differing only slightly from the actual one—contain serious harm.[101] Risk tracks the closeness of such bad outcomes rather than their probability; hence a low-chance disaster may still count as high risk if only a small change would have led to it. On the normic account of risk, a situation is risky when the bad outcome would be normal or unsurprising.[99] Risk is assessed through system functions and norms rather than bare probability. A harm counts as high risk when it would occur in the most normal continuations of the present setup; the less departure from normality needed for the harm, the greater the risk. Especially in domains where we lack predictive power, such approaches allow us to consider risk without relying on unknown probabilities, as illustrated by the normic account ofsuicide risk.[102]
The experience of many people who rely on human services for support is that 'risk' is often used as a reason to prevent them from gaining further independence or fully accessing the community, and that these services are often unnecessarily risk averse.[103] "People's autonomy used to be compromised by institution walls, now it's too often our risk management practices", according toJohn O'Brien.[104] Michael Fischer and Ewan Ferlie (2013) find that contradictions between formal risk controls and the role of subjective factors in human services (such as the role of emotions and ideology) can undermine service values, so producing tensions and even intractable and 'heated' conflict.[105]
Anthony Giddens andUlrich Beck argued that whilst humans have always been subjected to a level of risk – such asnatural disasters – these have usually been perceived as produced by non-human forces. Modern societies, however, are exposed to risks such aspollution, that are the result of themodernization process itself. Giddens defines these two types of risks asexternal risks andmanufactured risks.[106] The termRisk society was coined in the 1980s and its popularity during the 1990s was both as a consequence of its links to trends in thinking about wider modernity, and also to its links to popular discourse, in particular the growing environmental concerns during the period.
state, even partial, of deficiency of information related to understanding or knowledge
Note 1: In some cases, uncertainty can be related to the organization's context as well as to its objectives.Note 2: Uncertainty is the root source of risk, namely any kind of "deficiency of information" that matters in relation to objectives (and objectives, in turn, relate to all relevant interested parties' needs and expectations).
Note 1: An objective can be strategic, tactical or operational.Note 2: Objectives can relate to different disciplines (such as financial, health and safety, and environmental goals) and can apply at different levels (such as strategic, organization-wide, project, product and process).Note 3: An objective can be expressed in other ways, e.g. as an intended outcome, a purpose, an operational criterion, as a management system objective, or by the use of other words with similar meaning (e.g. aim, goal, target).
^Blount, Thomas (1661).Glossographia, or, A dictionary interpreting all such hard words of whatsoever language now used in our refined English tongue. London.
^abcHansson, Sven Ove,"Risk",The Stanford Encyclopedia of Philosophy (Fall 2018 Edition), Edward N. Zalta (ed.)
^Project Risk Analysis and Management Guide. Association of Project Management. 1997.
^A Guide to the Project Management Body of Knowledge (4th Edition) ANSI/PMI 99-001-2008
^Frank Hyneman Knight "Risk, uncertainty and profit" pg. 19, Hart, Schaffner, and Marx Prize Essays, no. 31. Boston and New York: Houghton Mifflin. 1921.
^A guide to the project management body of knowledge (PMBOK guide) (5th ed.). Project Management Institute. 2013. p. 309.
^Boroomand, A. and Smaldino, P.E., 2021. Hard Work, Risk-Taking, and Diversity in a Model of Collective Problem Solving. Journal of Artificial Societies and Social Simulation, 24(4).
^Julian Talbot and Miles JakemanSecurity Risk Management Body of Knowledge, John Wiley & Sons, 2009.
^Brealey, R.A.; Myers, S.C.; Allen, F. (2017).Principles of Corporate Finance (12th ed.). New York: McGraw-Hill. p. 183.
^Björk, Tomas (2004).Arbitrage theory in Continuous Time. New York: Oxford University Press. pp. 136f.ISBN978-0-19-927126-9.
^Mandelbrot, Benoit and Richard L. Hudson (2008).The (mis)Behaviour of Markets: A Fractal View of Risk, Ruin and Reward. London: Profile Books.ISBN978-1-84668-262-9.
^abRisk Assessment and Risk Management in Regulatory Decision-Making. Presidential/Congressional Commission on Risk Assessment and Risk Management. 1997.
^AS/NZS 4360:1999 Risk Management. Standards Australia & Standards New Zealand. 1999.
^Risk: Improving government's capability to handle risk and uncertainty. Cabinet Office. 2002.
^"Risk management".Process Safety Glossary. Center for Chemical Process Safety. Retrieved29 October 2020.
^Lyon, Bruce (2016).Fundamental Techniques. In Popov G, Lyon BK, Hollcraft B (eds.). Risk Assessment: A Practical Guide to Assessing Operational Risks: John Wiley & Sons.
^Slovic, Paul (2010).The Feeling of Risk. Routledge.
^Öhman, A; Mineka, S (2001). "Fears, phobias, and preparedness: Toward an evolved module of fear and fear learning".Psychol Rev.108 (3):483–522.doi:10.1037/0033-295x.108.3.483.PMID11488376.
^Lichtenstein, S; Slovic, P; Fischhoff, B; Layman, M; Combs, B (1978). "Judged frequency of lethal events".Journal of Experimental Psychology: Human Learning and Memory.4 (6):551–578.doi:10.1037/0278-7393.4.6.551.hdl:1794/22549.
^Slovic, Paul (2000).The Perception of Risk. London: Earthscan. pp. 137–146.
^Douglas, Mary; Wildavsky, Aaron (1982).Risk and Culture: An Essay on the Selection of Technological and Environmental Dangers. Berkeley: University of California Press.
^Breakwell, Glynis (2014).The Psychology of Risk (2nd ed.). Cambridge University Press. p. 82.
^Virine, L., & Trumper, M. ProjectThink. Gower. 2013
^Virine, L., & Trumper, M. Project Risk Analysis Made Ridiculously Simple. World Scientific Publishing. 2017
^Amos Tversky / Daniel Kahneman, 1981. "The Framing of Decisions and the Psychology of Choice."[verification needed]
^Schatz, J.; Craft, S.; Koby, M.; DeBaun, M. R. (2004). "Asymmetries in visual-spatial processing following childhood stroke".Neuropsychology.18 (2):340–352.doi:10.1037/0894-4105.18.2.340.PMID15099156.
^Drake, R. A. (2004). Selective potentiation of proximal processes: Neurobiological mechanisms for spread of activation. Medical Science Monitor, 10, 231–234.
^Kurt, Didem; Inman, J. Jeffrey; Argo, Jennifer J. (2011). "The influence of friends on consumer spending: The role of agency-communion orientation and self-monitoring".Journal of Marketing Research.48 (4):741–754.doi:10.1509/jmkr.48.4.741.S2CID143542642.
^Dommer, Sara Loughran; Swaminathan, Vanitha (2013). "Explaining the endowment effect through ownership: The role of identity, gender, and self-threat".Journal of Consumer Research.39 (5):1034–1050.doi:10.1086/666737.
^Bernstein, Peter L. (2012).Against the Gods: The Remarkable Story of Risk. Hoboken: Wiley.ISBN978-0-471-29563-1.
^Beck, Ulrich (1992).Risk society: towards a new modernity. Theory, culture & society. London; Newbury Park, Calif: Sage Publications.ISBN978-0-8039-8345-8.
Niklas Luhmann, 1996:Modern Society Shocked by its Risks (= University of Hong Kong, Department of Sociology Occasional Papers 17), Hong Kong, available viaHKU Scholars HUB
HistorianDavid A. Moss' bookWhen All Else Fails explains theUS government's historical role as risk manager of last resort.
Bernstein P. L.Against the GodsISBN0-471-29563-9. Risk explained and its appreciation by man traced from earliest times through all the major figures of their ages in mathematical circles.
Rescher, Nicholas (1983).A Philosophical Introduction to the Theory of Risk Evaluation and Measurement. University Press of America.
Porteous, Bruce T.; Pradip Tapadar (December 2005).Economic Capital and Financial Risk Management for Financial Services Firms and Conglomerates. Palgrave Macmillan.ISBN978-1-4039-3608-0.
Cevolini, A (2015). ""Tempo e decisione. Perché Aristotele non-ha un concetto di rischio?" PDF".Divus Thomas.118 (1):221–249.
Clark, L.; Manes, F.; Antoun, N.;Sahakian, B. J.; Robbins, T. W. (2003). "The contributions of lesion laterality and lesion volume to decision-making impairment following frontal lobe damage".Neuropsychologia.41 (11):1474–1483.doi:10.1016/s0028-3932(03)00081-2.PMID12849765.S2CID46447795.
Drake, R. A. (1985). "Decision making and risk taking: Neurological manipulation with a proposed consistency mediation".Contemporary Social Psychology.11:149–152.
Drake, R. A. (1985). "Lateral asymmetry of risky recommendations".Personality and Social Psychology Bulletin.11 (4):409–417.doi:10.1177/0146167285114007.S2CID143899523.
Gregory, Kent J.; Bibbo, Giovanni; Pattison, John E. (2005). "A Standard Approach to Measurement Uncertainties for Scientists and Engineers in Medicine".Australasian Physical and Engineering Sciences in Medicine.28 (2):131–139.doi:10.1007/bf03178705.PMID16060321.S2CID13018991.
Hansson, Sven Ove. (2007). "Risk",The Stanford Encyclopedia of Philosophy (Summer 2007 Edition), Edward N. Zalta (ed.), forthcoming[1].
Holton, Glyn A. (2004). "Defining Risk",Financial Analysts Journal, 60 (6), 19–25. A paper exploring the foundations of risk. (PDF file).
Knight, F. H. (1921)Risk, Uncertainty and Profit, Chicago: Houghton Mifflin Company. (Cited at:[2], § I.I.26.).
Kruger, Daniel J., Wang, X.T., & Wilke, Andreas (2007) "Towards the development of an evolutionarily valid domain-specific risk-taking scale"Evolutionary Psychology (PDF file).
Miller, L.; Milner, B. (1985). "Cognitive risk taking after frontal or temporal lobectomy II. The synthesis of phonemic and semantic information".Neuropsychologia.23 (3):371–379.doi:10.1016/0028-3932(85)90023-5.PMID4022304.S2CID31082509.
