How is risk quantified using likelihood and consequence?

• A. Add likelihood and consequence
• B. Multiply likelihood and consequence to yield a risk score
• C. Use qualitative scales only
• D. Use probability alone

Answer: (B)

In risk assessment, you quantify risk by combining how likely an event is with how severe its impact would be. Multiplying likelihood by consequence to yield a risk score is used because it captures the interaction between these two dimensions: risk rises when both the chance of the event and its potential damage are high, and it drops to zero if either factor is zero. This multiplicative approach also provides a clear, scalable numeric rating that teams can rank and compare across different risks. If you added likelihood and consequence instead, you’d blur the effect of a high-probability, high-impact event, underestimating or overestimating risk in ways that don’t reflect how likely and how damaging the event would be. Relying on probability alone ignores how bad the outcome could be, and relying only on qualitative scales wouldn’t give a single numeric score to rank risks.