Risk Likelihood

Overview

Risk likelihood is an estimate of how probable or frequent a risk event is within a defined period and under stated conditions.

Risk Likelihood is closely connected to Risk Impact, Risk Matrix, and Risk Event. It differs from impact and should not be inferred solely from historical frequency when threats, exposure, controls, or business conditions are changing.

Operational implementation should define the time horizon, use internal and external evidence, account for control strength and exposure, express uncertainty, avoid unsupported precision, consider scenario and threat intelligence, and recalibrate after events.

The principal failure modes include small samples, base-rate neglect, stale data, optimism bias, confusing possibility with probability, hidden dependencies, and scoring scales that different teams interpret differently.

Useful measures include forecast calibration, events by likelihood tier, rating changes, model error, control-adjusted likelihood, and overdue reassessments.

Operationally, teams should define the time horizon, use internal and external evidence, account for control strength and exposure, and express uncertainty. Key risks include small samples, base-rate neglect, stale data, and optimism bias.

For Risk Likelihood, the assessment should evaluate an estimate of how probable or frequent a risk event is within a defined period and under stated conditions. The assessment record should separate observed evidence supporting an estimate of how probable or frequent a risk event is within a defined period and under stated conditions from assumptions, state the time horizon and existing controls, and identify who owns any remaining exposure. Monitoring should test whether the conditions described in an estimate of how probable or frequent a risk event is within a defined period and under stated conditions have changed enough to require a new rating, treatment, or approval.