A Risk has three (3) components:

1. A future root cause (yet to happen), which, if eliminated or corrected, would prevent a potential consequence from occurring,
2. A probability (or likelihood) assessed at the present time of that future root cause occurring, and
3. The consequence (or effect) of that future occurrence.

Consequence (effect)

The outcome of a future occurrence is expressed qualitatively or quantitatively, being a loss, injury, disadvantage, or gain. However, the consequence varies with each risk in terms of cost, schedule, and impact on health, human life, or some other critical factor. The consequence has to be weighted in terms of the probability of it occurring.

Probability (likelihood)

A risk is an event that “may” occur. The probability of it occurring can range anywhere from just above 0 percent to just below 100 percent. (Note: It can’t be exactly 100 percent, because then it would be a certainty, not a risk. And it can’t be exactly 0 percent, or it wouldn’t be a risk.)

Probability is often represented on a Risk Reporting Matrix.

AcqLinks and References:

• DoD Risk, Issue, and Opportunity Management Guide for Defense Acquisitions- Jan 2017
• (Old) DoD Risk Management Guidebook – Aug 06
• Risk Assessment Checklist
• Risk Assessment Worksheet and Management Plan
• Continuous Risk Management Guidebook by Carnegie Melon
• Template: Risk Management Plan
• Template: Project Rick Management Template

Updated: 8/11/2021