How are probability and impact combined to yield a risk level?

• A. They are combined by multiplying probability by impact, using a matrix or numerical scoring
• B. They are added together to form the risk level
• C. They are used independently without combination
• D. They are divided to determine risk tolerance

Answer: (A)

Combining probability and impact by multiplying them yields a single risk score that captures both how likely an event is and how severe its consequences would be. This product provides a consistent way to compare and rank different risks, because high likelihood paired with high impact produces a much larger score than either factor alone. In practice, this score is placed on a risk matrix or mapped to a numerical scale, allowing you to categorize risks as low, medium, high, or extreme and to prioritize where to focus mitigation efforts.

Using an additive approach doesn’t reflect the way risk compounds, since a high likelihood with moderate impact can end up being as risky as a moderate likelihood with high impact, which an addition scheme may misrepresent. Treating probability and impact as independent means there’s no single metric to directly compare all risks. Dividing to determine risk tolerance mixes the assessment with appetite or acceptance levels, which is a separate consideration from calculating the risk itself. So multiplying probability by impact and mapping the result to a risk level is the standard, effective method for assessing and prioritizing risk.