How is the risk score calculated in risk assessment?

• A. probability x impact
• B. impact minus probability
• C. probability plus impact
• D. impact divided by probability

Answer: (A)

In risk assessment, risk is seen as the combination of how likely something is and how bad its consequences would be. The standard way to quantify that is by multiplying the probability of occurrence by the impact (consequence). This product captures the idea that risk grows when either factor is higher and becomes especially large when both are high.

For example, a scenario with a 0.2 probability and an impact of 8 yields a risk score of 1.6. A scenario with a high probability (0.8) but lower impact (3) yields 2.4. The multiplication reflects the joint effect of both factors.

Other operations don’t represent how risk compounds. Addition would distort risk by not respecting how a small probability with huge impact can still be significant, subtraction isn’t a meaningful way to combine these factors, and division misrepresents the interaction between likelihood and consequence. Therefore, probability multiplied by impact is the best approach.