Geoscience Reference
In-Depth Information
Likelihood of occurrence
Severity of
consequences
Frequent
Seldom
Unlikely
Likely
Occasional
Highest
priority
Catastrophic
Critical
Moderate
priority
Moderate
Lowest
priority
Negligible
Figure 8.2
Illustrative risk matrix.
Risk Equation
Some methodologies seek a single measure that allows comparison of alternative
countermeasures. Such a measure can be used to rank order or prioritize counter-
measures. One approach is to calculate a risk number that is a function of prob-
ability of attack, system effectiveness, and consequence. A simple formula for risk
defined in this manner is
Risk =
R
=
P
A
× (1 -
P
E
) ×
C
where
P
A
= likelihood of occurrence (attack)
P
E
= system effectiveness [therefore (1 -
P
E
) = system ineffectiveness]
C
= consequence value
In some approaches, consequence value is directly addressed by assigning, for
example, a low, medium, or high value. Similarly, likelihood of occurrence and
system effectiveness are combined by assigning, for example, a low, medium, or
high value. Finally, to calculate a “risk value,” one converts low, medium, and high
assignments to 0.1, 0.5, and 0.9 values, respectively, and inserts the numbers into
the risk equation to calculate a risk value. Or, numerical values are determined by
constructing and running models that yield likelihoods and consequences.
Another variation calls for specification of several consequences and corre-
sponding measures (e.g., economic loss in dollars, duration of loss in hours, num-
ber of customers impacted, fatalities, and illnesses). These must then be combined
in some fashion to construct a single measure of consequence value. This can be
done by considering all of the measures and simply assigning a single measure
