How is risk best quantified within an ISO 55001 compliant Asset Management System?

The most widely accepted and fundamental method for quantifying risk, consistent with ISO 31000 (the reference standard for risk management in ISO 55001), is by considering both the likelihood of an event occurring and the severity of its consequences. Risk is expressed as a function of these two components. Therefore, quantifying risk by multiplying the event probability (or frequency) by the event consequences provides a comparable measure of the level of risk, enabling prioritization and informed decision-making within the asset management system.

A. This describes a specific application (a risk matrix for unavailability) but is not the universal definition of risk quantification.

B. Defining risk appetite sets tolerance levels; it is a framework for evaluating quantified risk, not the method of quantification itself.

D. Risk identification is the process of finding and describing risks. The subsequent step, risk analysis, involves quantification.

E. This is false. Risk can be and is regularly quantified, both qualitatively (e.g., high/low) and quantitatively (e.g., expected financial loss).

1. ISO 31000:2018, Risk management — Guidelines, Clause 6.4.3, "Risk analysis", states that risk analysis involves considering the causes and sources of risk, their positive and negative consequences, and the likelihood that those consequences can occur.

2. The Institute of Asset Management (IAM). (2015). Asset Management - An Anatomy (Version 3.0). Section 3.5.2, "Risk Management", describes risk as "a combination of the probability of an event and its consequence".

3. ISO 55000:2014, Asset management — Overview, principles and terminology, Clause 2.5, notes that risk management should be conducted in accordance with ISO 31000.