Individual risk assessment[edit]

Risk assessment is necessary in individual cases, including patient and physician interactions.
[3]
 Individual judgements or assessments of risk may be affected by psychological, ideological,
religious or otherwise subjective factors, which impact rationality of the process. [3]
A systematic review of patients and doctors from 2017 found that overstatement of benefits and
understatement of risks occurred more often than the alternative. [3][4]
There is a tendency for individuals to be less rational when risks and exposures concern
themselves as opposed to others.[3] There is also a tendency to underestimate risks that are
voluntary or where the individual sees themselves as being in control, such as smoking. [3] A 2017
systematic review from the Cochrane collaboration suggests "well-documented decision aids"
are helpful in reducing effects of such tendencies or biases. [3][5] The ways statistics are expressed
and communicated, both through words and numerically also impact the interpretation of benefit
and harm. For example, a fatality rate may be interpreted as less benign than the corresponding
survival rate.[3]

Systems risk assessment[edit]

Risk assessment can also be made on a much larger "systems" scale, for example assessing the
risks of a nuclear power plant (an interactively complex mechanical, electronic, nuclear, and
human system) or a hurricane (a complex meteorological and geographical system). Systems
may be defined as linear and nonlinear (or complex), where linear systems are predictable and
relatively easy to understand given a change in input, and non-linear systems unpredictable
when inputs are changed.[6] As such, risk assessments of non-linear/complex systems tend to be
more challenging.
In the engineering of complex systems, sophisticated risk assessments are often made
within safety engineering and reliability engineering when it concerns threats to life, environment,
or machine functioning. The agriculture, nuclear, aerospace, oil, railroad, and military industries
have a long history of dealing with risk assessment. [7] Also, medical, hospital, social service,[8] and
food industries control risks and perform risk assessments on a continual basis. Methods for
assessment of risk may differ between industries and whether it pertains to general financial
decisions or environmental, ecological, or public health risk assessment. [7]

Concept[edit]
Rapid technological change, increasing scale of industrial complexes, increased system
integration, market competition, and other factors have been shown to increase societal risk in
the past few decades.[1] As such, risk assessments become increasingly critical in mitigating
accidents, improving safety, and improving outcomes. Risk assessment consists of an objective
evaluation of risk in which assumptions and uncertainties are clearly considered and presented.
This involves identification of risk (what can happen and why), the potential consequences,
the probability of occurrence, the tolerability or acceptability of the risk, and ways to mitigate or
reduce probability of the risk.[2] Optimally, it also involves documentation of the risk assessment
and its findings, implementation of mitigation methods, and review of the assessment (or risk
management plan), coupled with updates when necessary.[1] Sometimes risks can be deemed
acceptable, meaning the risk "is understood and tolerated ... usually because the cost or difficulty
of implementing an effective countermeasure for the associated vulnerability exceeds the
expectation of loss."[9]
Part of the difficulty in managing risk is that both the quantities by which risk assessment is
concerned—potential loss and probability of occurrence—can be very difficult to measure. The
chance of error in measuring these two concepts is high. Risk with a large potential loss and a
low probability of occurrence is often treated differently from one with a low potential loss and a
high likelihood of occurrence. In theory, both are of near equal priority, but in practice it can be
very difficult to manage when faced with the scarcity of resources—especially time—in which to
conduct the risk management process.
Mathematical conceptualization[edit]

Risk assessment from a financial point of view.

To see the risk management process expressed mathematically, one can define total risk as the
sum over individual risks, , which can be computed as the product of potential losses, , and their
probabilities, :
Even though for some risks , we might have , if the probability  is small compared to , its
estimation might be based only on a smaller number of prior events, and hence, more
uncertain. On the other hand, since ,  must be larger than , so decisions based on this
uncertainty would be more consequential, and hence, warrant a different approach.
Financial decisions, such as insurance, express loss in terms of dollar amounts. When
risk assessment is used for public health or environmental decisions, loss can be
quantified in a common metric such as a country's currency or some numerical measure
of a location's quality of life. For public health and environmental decisions, loss is simply
a verbal description of the outcome, such as increased cancer incidence or incidence of
birth defects. In that case, the "risk" is expressed as
If the risk estimate takes into account information on the number of individuals
exposed, it is termed a "population risk" and is in units of expected increased cases
per a time period. If the risk estimate does not take into account the number of
individuals exposed, it is termed an "individual risk" and is in units of incidence rate
per a time period. Population risks are of more use for cost/benefit analysis;
individual risks are of more use for evaluating whether risks to individuals are
"acceptable".
Quantitative risk assessment[edit]
Further information: Quantitative risk assessment software
In quantitative risk assessment an annualized loss expectancy (ALE) may be used
to justify the cost of implementing countermeasures to protect an asset. This may be
calculated by multiplying the single loss expectancy (SLE), which is the loss of value
based on a single security incident, with the annualized rate of occurrence (ARO),
which is an estimate of how often a threat would be successful in exploiting a
vulnerability.