Risk = Probability X Consequences. Really?

(image from www.impactlab.net)

Probably the most frequently used definition of risk is this one:

Risk = the Probability of something happening X resulting Cost/Consequences

This definition is flawed because of two fundamental reasons, which the formula itself suggests very eloquently:

1. Estimation of probabilities of future events is very difficult (while it is considerably easier when talking of past events). Rare events have very low probabilities and these are extremely difficult to estimate due to the fact that the sample of available data is very small (what is the probability of an event similar to 9/11?). Since this factor multiplies the “cost” in the above equation it is of paramount importance.

2. Estimation of the costs/consequences of these events. This is most difficult. Even after a catastrophic event it is difficult to estimate the total damage and cost.

However, the most important flaw is hidden and it is conceptual…