In the standard scientific and regulatory definition of risk used byFEMA,ISO 31000, and theIBFCSM, risk is fundamentally expressed as a function ofLikelihood and Consequence. This is often simplified into the mathematical formula $Risk = Probability \times Impact$. "Likelihood" refers to the probability or frequency with which a specific hazard (e.g., a flood, earthquake, or cyber-attack) is expected to occur. "Consequence" (or Impact) refers to the severity of the result if that hazard does manifest, measured in terms of life safety, economic loss, environmental damage, and infrastructure failure.
While "Vulnerability" (Option C) and "Resilience" (Option B) are critical components of the riskequation, they are not the primary terms used to describe the risk itself. Vulnerability describes the characteristics of an asset that make it susceptible to a hazard, and Resilience describes the ability to recover. However, to prioritize emergency preparedness efforts, planners first plot hazards on aRisk Matrixusing likelihood and consequence. A high-likelihood, low-consequence event (like a localized power outage) might require different preparedness steps than a low-likelihood, high-consequence event (like a nuclear detonation).
According to theCEDPcurriculum, understanding these two terms allows for the objective ranking of threats. This ranking is the core of theHazard Identification and Risk Assessment (HIRA)process. By quantifying the likelihood (e.g., a "100-year flood" has a 1% annual likelihood) and the consequence (e.g., $10 million in projected damage), emergency managers can justify the costs of mitigation and preparedness projects to stakeholders and government officials. It ensures that resources are directed toward the most significant "Realized Risks"—those that are both plausible and potentially devastating.
