When completing a risk assessment, which TWO characteristics of a risk should be quantitatively examined?

Quantitative risk assessment involves assigning numerical values to the characteristics of a risk to determine its overall level. The two primary characteristics used in this calculation are the 'likelihood' (or probability) of the risk occurring and the 'severity' (or impact) of its consequences should it materialize. These are often rated on a numerical scale (e.g., 1-5) or assigned specific values (e.g., probability as a percentage, severity as a monetary value). The product of these two factors (Risk = Likelihood x Severity) provides a quantitative risk score, which is crucial for prioritizing risks for treatment and resource allocation.

B. type of risk: This is a qualitative classification (e.g., financial, operational, strategic) used for categorization, not a numerical measurement for quantitative analysis.

C. risk owner: This identifies the person or role responsible for managing the risk, which is a qualitative assignment of accountability, not a quantitative characteristic.

1. ISO 31000:2018, Risk management — Guidelines. Section 6.4.3, "Risk analysis," states that the process involves a detailed consideration of consequences (severity) and likelihood. It specifies that analysis techniques can be qualitative, semi-quantitative, or quantitative, all of which are based on these two fundamental components.

2. Hopkin, P. (2018). Fundamentals of Risk Management: Understanding, Evaluating and Implementing Effective Risk Management (5th ed.). Kogan Page. Chapter 10, "Risk Assessment Techniques," explains that quantitative risk assessment "requires a numerical estimate of both the likelihood of the risk occurring and the financial or other consequences (impact/severity) if it does occur" (p. 167).

3. Aven, T. (2016). Risk Assessment and Risk Management: Review of Recent Advances on their Foundation. European Journal of Operational Research, 253(1), 1-13. This peer-reviewed article establishes the foundational risk assessment formula as a function of probability (likelihood) and consequences (severity). It states, "The common approach to risk assessment is to use probabilities to express the uncertainties about the events and their consequences" (Section 2.1, p. 2). DOI: https://doi.org/10.1016/j.ejor.2015.12.023