Which of the following formula represents the risk levels?

The standard formula for calculating risk is a function of the probability of a threat event occurring and the resulting adverse impact or consequence. The formula Level of risk = Consequence × Likelihood accurately represents this fundamental principle of risk management. "Likelihood" refers to the probability of a threat exploiting a vulnerability, while "Consequence" (or Impact) refers to the magnitude of harm that would result. This calculation is central to prioritizing risks and making informed decisions about security controls.

A. Level of risk = Consequence × Severity: Severity is a component or synonym of consequence/impact, making this formula redundant and conceptually incorrect.
B. Level of risk = Consequence × Impact: Consequence and impact are used interchangeably in risk management; multiplying them together is not a standard risk calculation.
D. Level of risk = Consequence × Asset Value: Asset value is a key factor in determining the consequence/impact, but it is not the complete picture, and this formula omits the critical likelihood component.

National Institute of Standards and Technology (NIST). (2012). Guide for Conducting Risk Assessments (NIST Special Publication 800-30, Revision 1). Section 2.3, "Risk," p. 8. The document defines risk as "a function of the likelihood of a given threat-source’s exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization."

Peltier, T. R. (2010). Information Security Risk Analysis (3rd ed.). Auerbach Publications. Chapter 3, "Risk Analysis," p. 37, describes the risk formula as Risk = Probability of Occurrence × Magnitude of Impact/Consequence. (ISBN: 978-1-4398-3955-0)