The probability of a threat or risk to occur is defined as _____________

In the context of risk management and business continuity, as defined by ISO standards, 'likelihood' is the term used to describe the chance or probability of something happening. Risk is formally assessed by analyzing its two primary components: the likelihood of the threat or risk occurring and the potential impact (or consequence) if it does. Therefore, likelihood directly corresponds to the probability of an occurrence.

B. Risk appetite: This is the amount and type of risk that an organization is prepared to pursue, retain, or take, not the probability of a specific risk occurring.

C. Control: This is a measure or action that modifies risk. It is a response to risk, not a component of its initial definition or measurement.

D. Impact: This refers to the consequence or outcome of an event if it occurs. It measures the severity of the harm, not the probability of it happening.

1. International Organization for Standardization (ISO). (2019). ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements.

Section 3.23: Defines 'likelihood' as the "chance of something happening." This is the official definition within the standard itself.

Section 8.2.2 (Risk assessment): The standard requires the organization to implement a formal risk assessment process that systematically identifies, analyzes, and evaluates the risk of disruption. This process inherently involves assessing the likelihood and impacts of potential disruptions.

2. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Section 3.7: Defines 'likelihood' as the "chance of something happening." This foundational risk management standard provides the core terminology used across other ISO management systems, including ISO 22301.

3. Heng, G. M. (2011). A Manager's Guide to ISO 22301. The Chartered Quality Institute.

Chapter 8: Risk Assessment and Treatment: This guide explains that risk analysis involves determining the "consequences and their likelihood" for identified risk scenarios. It explicitly states, "Likelihood is the chance of something happening."

4. Järveläinen, J. (2012). Information security and business continuity management in interorganizational IT relationships. Proceedings of the 45th Hawaii International Conference on System Sciences.

Section: Risk Management in IS and BCM, p. 3536: The paper discusses risk assessment methodologies in BCM, stating, "Risk is commonly defined as a function of the likelihood of a certain threat source's exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization." This aligns with the ISO definition. (DOI: 10.1109/HICSS.2012.139)