Risk Analysis Formula

Managing risk is a vital part of creating a secure and resilient infrastructure. Since there are limited resources available, an organization must prioritize risks in order to determine how to best use its resources to minimize risk. This is accomplished in part by identifying potential threats, and then using a formula to calculate the potential risk of given threats. (this will provide a prioritized list of threats to focus on)

Risk Score = Threat x Vulnerability x Consequence

While a risk analysis, in part, is intended to provide a prioritized list of threats, for this discussion, simply select one example of a threat that could impact your sector, or a particular region of your sector. Provide a risk score based on the formula above (use a 1-10 scale for each variable. 1=lowest and 10 for highest

1) List a viable threat. (could be geographically specific)

2) How Vulnerable is the sector to the threat? (based on statistical data from previous occurrences or an analysis by a subject matter expert)

3) What is the consequence to your sector should the threat actually occur? (based on statistical data from previous occurrences or an analysis by a subject matter expert)

I have provided 2 different examples below for the same type of event in order shed light on the difference in scores based on geographic locations:

EXAMPLE 1 (remember, the numbers are simply a best guess, so don't fret about getting them exact)

Impact area: Water Wastewater Sector in New Orleans

• Threat = 1 Sub-freezing temperatures for extended period of time (uncommon occurrence)


• Vulnerability = 9 (most water systems in New Orleans are not designed for such an event)


• Consequence = 7 (2018 storm reflected a significant impact on the water system)

1 x 9 x 7 = 63

Risk score = 63 (this a relative score would be ranked against other risk assessments)

EXAMPLE 2 (remember, the numbers are simply a best guess)

• Impact area: Water Wastewater Sector in Denver, Colorado


• Threat = 9 (Extended periods of sub-freezing weather is common)


• Vulnerability = 1 (Colorado regulations insure that water systems are designed for such an event)


• Consequence = 3 (extreme freezing weather has some impact on water systems but no major impacts)

9 x 1 x 3 = 27

Risk score = 27 (this a relative score would be ranked against other risk assessments)