What is defined as the effect of uncertainty on objectives?

Risk is formally defined as "the effect of uncertainty on objectives". This definition is adopted from the international standard for risk management, ISO 31000, and is explicitly used within The Open Group's TOGAF® framework. An effect is a deviation from what is expected, which can be positive (an opportunity) or negative (a threat). In the context of enterprise architecture, risk management involves identifying, analyzing, and evaluating these uncertainties to increase the likelihood of achieving business and architectural objectives.

A. Vulnerability: A weakness in an asset or control that can be exploited by one or more threats. It is a condition that contributes to risk, not the effect of uncertainty.

C. Continuity: Refers to the capability of an organization to continue the delivery of products or services at acceptable predefined levels following a disruptive incident. It is a goal, not the effect of uncertainty.

D. Threat: A potential cause of an unwanted incident, which may result in harm to a system or organization. It is a source of risk, not the risk itself.

1. The Open Group

"The TOGAF® Standard

Version 10

" Part 1: Introduction and Core Concepts

Chapter 3: Definitions

Section 3.83 "Risk". The standard explicitly defines Risk as: "The effect of uncertainty on objectives... (Source: ISO 31000:2009)".

2. The Open Group

"TOGAF® Series Guide: Integrating Risk and Security within a TOGAF® Enterprise Architecture" (G152)

January 2016

Section 2.1 Key Concepts. It states

"Risk is the effect of uncertainty on objectives. This definition is taken from ISO 31000...".

3. International Organization for Standardization

"ISO 31000:2018

Risk management — Guidelines

" Clause 3.1 Terms and definitions. The standard defines risk as the "effect of uncertainty on objectives".