View source for Risk assessment

{{short description| Estimation of risk associated with exposure to a given set of hazards }}
{{cs1 config|name-list-style=vanc|display-authors=6}}
{{Lead too short|date=February 2021}}
'''Risk assessment''' determines possible mishaps, their likelihood and consequences, and the [[engineering tolerance|tolerances]] for such events.<ref name="RausandRisk13" /> <ref>Neil Hodge (2021). [https://web.archive.org/web/20210201151624/https://www.rmmagazine.com/2021/02/01/how-to-address-low-probability-high-impact-risks/ "How to Address Low-Probability, High-Impact Risks"], [[Risk Management (magazine)|''Risk Management'']]</ref>
The results of this process may be expressed in a [[Quantitative property|quantitative]] or [[Qualitative data|qualitative]] fashion. Risk assessment is an inherent part of a broader [[risk management]] strategy to help reduce any potential risk-related consequences.<ref name="RausandRisk13" /><ref name="PopovRisk16" />
[[File:Risk Assessment and Risk Management.png|thumb|Risk assessment and risk management [[Venn diagram]]]]

More precisely, risk assessment identifies and analyses potential (future) events that may negatively impact individuals, assets, and/or the environment (i.e. [[hazard analysis]]). It also makes judgments "on the [[tolerability]] of the risk on the basis of a risk analysis" while considering influencing factors (i.e. risk evaluation).<ref name="RausandRisk13">{{cite book |chapter-url=https://books.google.com/books?id=9EHeLmbUVh8C&pg=PT21 |chapter=Chapter 1: Introduction |title=Risk Assessment: Theory, Methods, and Applications | vauthors=Rausand M |publisher=John Wiley & Sons |pages=1–28 |year=2013 |isbn=9780470637647}}</ref><ref name="PopovRisk16">{{cite book |chapter-url=https://books.google.com/books?id=zqjLCgAAQBAJ&pg=PA2 |chapter=Chapter 1: Risk Assessments: Their Significance and the Role of the Safety Professional |title=Risk Assessment: A Practical Guide to Assessing Operational Risks | vauthors=Manuele FA | veditors=Popov G, Lyon BK, Hollcraft B |publisher=John Wiley & Sons |pages=1–22 |year=2016 |isbn=9781118911044}}</ref>

==Categories==
===Individual risk assessment===
Risk assessments can be done in [[individual]] cases, including in patient and physician interactions.<ref name="Levi 2018">{{Cite web|url=https://www.sbu.se/en/publications/medical-and-social-science--practice/getting-real-about-both-benefits-and-risks/ |title=Getting Real About Both Benefits and Risks | vauthors = Levi R | date = 1 June 2018 | publisher = Swedish Agency of Health Technology Assessment and Assessment of Social Services|language=en| work = Science & Practice, English Special 2018 |issn=1104-1250|access-date=2018-06-14}}</ref> In the narrow sense chemical risk assessment is the assessment of a health risk in response to environmental exposures.<ref name="Varshavsky">{{cite journal | vauthors = Varshavsky JR, Rayasam SD, Sass JB, Axelrad DA, Cranor CF, Hattis D, Hauser R, Koman PD, Marquez EC, Morello-Frosch R, Oksas C, Patton S, Robinson JF, Sathyanarayana S, Shepard PM, Woodruff TJ | display-authors = 6 | title = Current practice and recommendations for advancing how human variability and susceptibility are considered in chemical risk assessment | journal = Environmental Health | volume = 21 | issue = Suppl 1 | pages = 133 | date = January 2023 | pmid = 36635753 | pmc = 9835253 | doi = 10.1186/s12940-022-00940-1 | doi-access = free | bibcode = 2023EnvHe..21S.133V }}</ref>
The ways statistics are expressed and communicated to an individual, both through words and numbers impact his or her interpretation of benefit and harm. For example, a [[fatality rate]] may be interpreted as less benign than the corresponding [[survival rate]].<ref name="Levi 2018" />
A [[systematic review]] of patients and doctors from 2017 found that overstatement of benefits and understatement of risks occurred more often than the alternative.<ref name="Levi 2018" /><ref>{{cite journal | vauthors=Hoffmann TC, Del Mar C | title=Patients' expectations of the benefits and harms of treatments, screening, and tests: a systematic review | journal=JAMA Internal Medicine | volume=175 | issue=2 | pages=274–86 | date=February 2015 | pmid=25531451 | doi=10.1001/jamainternmed.2014.6016 | url=http://espace.library.uq.edu.au/view/UQ:351727/UQ351727_OA.pdf }}</ref>
A systematic review from the [[Cochrane (organisation)|Cochrane collaboration]] suggested "well-documented decision aids" are helpful in reducing effects of such tendencies or biases.<ref name="Levi 2018" /><ref name="Stacey_2024">{{cite journal | vauthors = Stacey D, Lewis KB, Smith M, Carley M, Volk R, Douglas EE, Pacheco-Brousseau L, Finderup J, Gunderson J, Barry MJ, Bennett CL, Bravo P, Steffensen K, Gogovor A, Graham ID, Kelly SE, Légaré F, Sondergaard H, Thomson R, Trenaman L, Trevena L | display-authors = 6 | title = Decision aids for people facing health treatment or screening decisions | journal = The Cochrane Database of Systematic Reviews | volume = 1 | issue = 1 | pages = CD001431 | date = January 2024 | pmid = 38284415 | pmc = 10823577 | doi = 10.1002/14651858.CD001431.pub6 }}</ref> Aids may help people come to a decision about their care based on evidence informed information that align with their values.<ref name="Stacey_2024" /> Decision aids may also help people understand the risks more clearly, and they empower people to take an active role when making medical decisions.<ref name="Stacey_2024" /> The systematic review did not find a difference in people who regretted their decisions between those who used decision aids and those who had the usual standard treatment.<ref name="Stacey_2024" /> 

An individual´s own [[risk perception]] may be affected by psychological, ideological, religious or otherwise subjective factors, which impact rationality of the process.<ref name="Levi 2018" /> Individuals tend to be less rational when risks and exposures concern themselves as opposed to others.<ref name="Levi 2018" /> There is also a tendency to underestimate risks that are voluntary or where the individual sees themselves as being in control, such as smoking.<ref name="Levi 2018" />

===Systems risk assessment===
Risk assessment can also be made on a much larger [[systems theory]] scale, for example assessing the risks of an ecosystem or an interactively complex mechanical, electronic, nuclear, and biological system or a hurricane (a complex meteorological and geographical system). Systems may be defined as linear and nonlinear (or complex), where linear systems are predictable and relatively easy to understand given a change in input, and non-linear systems unpredictable when inputs are changed.<ref name="RausandRisk13-6">{{cite book |chapter-url=https://books.google.com/books?id=9EHeLmbUVh8C&pg=PT166 |chapter=Chapter 6: Accident Models |title=Risk Assessment: Theory, Methods, and Applications | vauthors=Rausand M |publisher=John Wiley & Sons |pages=137–76 |year=2013 |isbn=9780470637647}}</ref> As such, risk assessments of non-linear/complex systems tend to be more challenging.

In the engineering of [[complex systems]], sophisticated risk assessments are often made within [[safety engineering]] and [[reliability engineering]] when it concerns threats to life, [[natural environment]], or machine functioning. The agriculture, nuclear, aerospace, oil, chemical, railroad, and military industries have a long history of dealing with risk assessment.<ref name="VamanuCritical16">{{cite book |title=Critical Infrastructures: Risk and Vulnerability Assessment in Transportation of Dangerous Goods: Transportation by Road and Rail | vauthors=Vamanu BI, Gheorghe AV, Kaina PF |publisher=Springer |page=11 |year=2016 |isbn=9783319309316}}</ref> Also, medical, hospital, [[social services|social service]],<ref name="LaceyAnApp11">{{cite journal | vauthors = Lacey P |title=An Application of Fault Tree Analysis to the Identification and Management of Risks in Government Funded Human Service Delivery |journal=Proceedings of the 2nd International Conference on Public Policy and Social Sciences |year=2011 |ssrn=2171117}}</ref> and food industries control risks and perform risk assessments on a continual basis. Methods for assessment of risk may differ between industries and whether it pertains to general financial decisions or environmental, ecological, or public health risk assessment.<ref name="VamanuCritical16" />

== Concept ==
Rapid technological change, increasing scale of industrial complexes, increased system integration, market competition, and other factors have been shown to increase societal risk in the past few decades.<ref name="RausandRisk13" /> As such, risk assessments become increasingly critical in mitigating accidents, improving safety, and improving outcomes. Risk assessment consists of an objective evaluation of [[risk]] in which assumptions and uncertainties are clearly considered and presented. This involves identification of risk (what can happen and why), the potential consequences, the [[Outcome (probability)|probability of occurrence]], the tolerability or [[acceptability]] of the risk, and ways to mitigate or reduce the probability of the risk.<ref name="PopovRisk16" /> Optimally, it also involves documentation of the risk assessment and its findings, implementation of mitigation methods, and review of the assessment (or risk management plan), coupled with updates when necessary.<ref name="RausandRisk13" /> Sometimes risks can be deemed acceptable, meaning the risk "is understood and tolerated ... usually because the cost or difficulty of implementing an effective countermeasure for the associated vulnerability exceeds the expectation of loss."<ref name="ShireyInternet07">{{cite journal |url=https://tools.ietf.org/html/rfc4949 |title=Internet Security Glossary, Version 2 | vauthors=Shirey R |journal=Network Working Group |publisher=The IETF Trust |page=9 |date=August 2007 |access-date=19 July 2018}}</ref>

=== Mild versus wild risk ===
Benoit Mandelbrot distinguished between "mild" and "wild" risk and argued that risk assessment and [[risk management]] must be fundamentally different for the two types of risk.<ref>{{Cite book|  vauthors = Mandelbrot B, Hudson RL |title=The (mis)Behaviour of Markets: A Fractal View of Risk, Ruin and Reward|publisher=Profile Books |year=2008 |isbn=9781846682629 |location=London}}</ref> Mild risk follows [[Normal distribution|normal]] or near-normal [[probability distribution]]s, is subject to [[Regression toward the mean|regression to the mean]] and the [[law of large numbers]], and is therefore relatively predictable. Wild risk follows [[fat-tailed distribution]]s, e.g., [[Pareto distribution|Pareto]] or [[power-law distributions]], is subject to regression to the tail (infinite mean or variance, rendering the law of large numbers invalid or ineffective), and is therefore difficult or impossible to predict. A common error in risk assessment and management is to underestimate the wildness of risk, assuming risk to be mild when in fact it is wild, which must be avoided if risk assessment and management are to be valid and reliable, according to Mandelbrot.

===Mathematical conceptualization===
[[Image:RiskAssessment.jpg|thumb|320px|Risk assessment from a financial point of view]]
To see the risk management process expressed mathematically, one can define [[Expected value#Random variables with finitely many outcomes|expected]] risk as the sum over individual risks, <math>R_i</math>, which can be computed as the product of potential losses, <math>L_i</math>, and their probabilities, <math>p(L_i)</math>:
:<math>R_i=L_i p(L_i)\,\!</math>
:<math>R_{exp}=\sum_i L_i p(L_i)\,\!</math>
Even though for some risks <math>R_i, R_j</math>, we might have <math>R_i = R_j</math>, if the probability <math>p(L_j)</math> is small compared to <math>p(L_i)</math>, its estimation might be based only on a smaller number of prior events, and hence, more uncertain. On the other hand, since <math>R_i = R_j</math>, <math>L_j</math> must be larger than <math>L_i</math>, so decisions based on this uncertainty would be more consequential, and hence, warrant a different approach.

This becomes important when we consider the [[variance]] of risk

:<math>R_{var}=\sum_i L_i^2 p(L_i) - \left(\sum_i R_i\right)^2</math>

as a large <math>L_i</math> changes the value.

Financial decisions, such as insurance, express loss in terms of dollar amounts.  When risk assessment is used for public health or environmental decisions, the loss can be quantified in a common metric such as a country's currency or some numerical measure of a location's quality of life.  For public health and environmental decisions, the loss is simply a verbal description of the outcome, such as increased cancer incidence or incidence of birth defects. In that case, the "risk" is expressed as
:<math>R_i= p(L_i)\,\!</math>
If the risk estimate takes into account information on the number of individuals exposed, it is termed a "population risk" and is in units of expected increased cases per time period. If the risk estimate does not take into account the number of individuals exposed, it is termed an "individual risk" and is in units of incidence rate per time period.  Population risks are of more use for cost/benefit analysis; individual risks are of more use for evaluating whether risks to individuals are "acceptable".

===Quantitative risk assessment===
{{Further|Quantitative risk assessment software}}
In quantitative risk assessment, an [[annualized loss expectancy]] (ALE) may be used to justify the cost of implementing countermeasures to protect an asset. This may be calculated by multiplying the [[single loss expectancy]] (SLE), which is the loss of value based on a single security incident, with the annualized rate of occurrence (ARO), which is an estimate of how often a threat would be successful in exploiting a vulnerability.

The usefulness of quantitative risk assessment has been questioned, however. [[Barry Commoner]], [[Brian Wynne]] and other critics have expressed concerns that risk assessment tends to be overly quantitative and reductive. For example, they argue that risk assessments ignore qualitative differences among risks. Some charge that assessments may drop out important non-quantifiable or inaccessible information, such as variations among the classes of people exposed to hazards, or social amplification.<ref name="Kasperson">{{cite journal | vauthors=Kasperson RE, Renn O, Slovic P, Brown HS, Emel J, Goble R, Kasperson JX, Ratick S | year=1988 | title=The social amplification of risk: A conceptual framework|journal=Risk Analysis|volume=8|issue=2|pages=177–187|doi=10.1111/j.1539-6924.1988.tb01168.x|url=http://elib.uni-stuttgart.de/bitstream/11682/7238/1/ren27.pdf |doi-access=free| bibcode=1988RiskA...8..177K }}</ref> Furthermore, Commoner<ref>{{cite book | vauthors=Commoner B | author-link1=Barry Commoner | chapter=Comparing apples to oranges: Risk of cost/benefit analysis | title=Contemporary moral controversies in technology | veditors=Iannone AP | pages=64–65 }}</ref> and O'Brien<ref>{{cite book |year=2002 | vauthors=O'Brien M |title=Making better environmental decisions: an alternative to risk assessment |place=Cambridge, Massachusetts |publisher=[[MIT Press]] |url=https://books.google.com/books?id=LtCOEN9HWIcC&q=Making+better+environmental |access-date=27 September 2010 | isbn=0-262-65053-3 }}</ref> claim that quantitative approaches divert attention from precautionary or preventative measures.<ref>{{cite book | vauthors = Shrader-Frechette K, Westra L |title=Technology and Values |date=October 1997 |publisher=Rowman & Littlefield Publishers |location=Lanham, Md. |isbn=978-1-4616-4399-9}}</ref> Others, like [[Nassim Nicholas Taleb]] consider risk managers little more than "blind users" of statistical tools and methods.<ref>{{cite report | vauthors = Taleb NN | title = The fourth quadrant: a map of the limits of statistics. | work = An Edge original essay | date = September 2008 | url = http://homepage.sns.it/hosni/lori/intranet/readings/Edge_the_fourth_quadrant_map_limits_of_statistics.pdf }}</ref>

== Process ==
Older textbooks distinguish between the term [[risk analysis]] and [[risk evaluation]];
a risk analysis includes the following 4 steps:<ref name="RausandRisk13"/>
* establish the context, which restricts the range of hazards to be considered. It is also necessary to identify the potential parties or assets which may be affected by the threat, and the potential consequences to them if the hazard is activated.
* [[hazard identification]], an ''identification of visible and implied hazards'' and ''determining the qualitative nature of the potential adverse consequences'' of each hazard. Without a potential adverse consequence, there is no hazard.
* [[frequency analysis]] If a consequence is dependent on dose, i.e. the amount of exposure, the relationship between dose and severity of consequence must be established, and the risk depends on the probable dose, which may depend on concentration or amplitude and duration or frequency of exposure. This is the general case for many [[health hazard]]s where the mechanism of injury is toxicity or repetitive injury, particularly where the  [[cumulative effects (environment)|effect is cumulative]].
* consequence analysis. For other hazards, the consequences may either occur or not, and the severity may be extremely variable even when the triggering conditions are the same. This is typical of many biological hazards as well as a large range of safety hazards. Exposure to a pathogen may or may not result in actual infection, and the consequences of infection may also be variable. Similarly, a fall from the same place may result in minor injury or death, depending on unpredictable details. In these cases, estimates must be made of reasonably likely consequences and associated probability of occurrence.

A risk evaluation means that judgements are made on the tolerability of the identified risks, leading to risk acceptance. When risk analysis and risk evaluation are made at the same time, it is called risk assessment.<ref name="RausandRisk13"/>

As of 2023, chemical risk assessment follows these 4 steps:<ref name="Varshavsky"/>
* [[hazard]] characterization
* [[exposure assessment]]
* [[dose-response]] modeling
* risk characterization.
There is tremendous variability in the [[dose-response relationship]] between a chemical and human health outcome in particularly susceptible subgroups, such as pregnant women, developing fetuses, children up to adolescence, people with low socioeconomic status, those with preexisting diseases, disabilities, [[genetic susceptibility]], and those with other [[environmental exposure]]s.<ref name="Varshavsky"/>

The process of risk assessment may be somewhat informal at the individual social level, assessing economic and household risks,<ref name="HolzmannSocial01">{{cite journal |title=Social Risk Management: A New Conceptual Framework for Social Protection, and Beyond |journal=International Tax and Public Finance | vauthors=Holzmann R, Jørgensen S |volume=8 |issue=4 |pages=529–56 |year=2001 |doi=10.1023/A:1011247814590|s2cid=14180040 }}</ref><ref name="NakašThree17">{{cite web |url=http://knowledgehub.cef-see.org/?p=1399 |title=Three Lessons About Risk Management from Everyday Life | vauthors=Nakaš N |work=Knowledge Hub |publisher=Center of Excellence in Finance |date=21 November 2017 |access-date=19 July 2018}}</ref> or a sophisticated process at the strategic corporate level. However, in both cases, ability to anticipate future events and create effective strategies for mitigating them when deemed unacceptable is vital.

At the individual level, identifying objectives and risks, weighing their importance, and creating plans, may be all that is necessary.
At the strategic organisational level, more elaborate policies are necessary, specifying acceptable levels of risk, procedures to be followed within the organisation, priorities, and allocation of resources.<ref name="Lock 2017" />{{rp|10}}

At the strategic corporate level, management involved with the project produce project level risk assessments with the assistance of the available expertise as part of the planning process and set up systems to ensure that required actions to manage the assessed risk are in place. At the dynamic level, the personnel directly involved may be required to deal with unforeseen problems in real time. The tactical decisions made at this level should be reviewed after the operation to provide feedback on the effectiveness of both the planned procedures and decisions made in response to the contingency.

=== Dose dependent risk ===
[[Image:Risk Based Sampling Nomogram (3yr).png|right|200px|thumb|Food risk assessment [[nomogram]]]]
{{unsourced section|date=March 2023}}
# ''Dose-Response Analysis'', is determining the relationship between dose and the type of adverse response and/or probability or the incidence of effect (dose-response assessment). The complexity of this step in many contexts derives mainly from the need to extrapolate results from experimental animals (e.g. [[mouse]], [[rat]]) to humans, and/or from high to lower doses, including from high acute occupational levels to low chronic environmental levels. In addition, the differences between individuals due to [[genetics]] or other factors mean that the hazard may be higher for particular groups, called susceptible populations. An alternative to dose-response estimation is to determine a concentration unlikely to yield observable effects, that is, a [[no effect concentration]]. In developing such a dose, to account for the largely unknown effects of animal to human extrapolations, increased variability in humans, or missing data, a prudent approach is often adopted by including safety or uncertainty factors in the estimate of the "safe" dose, typically a factor of 10 for each unknown step.
# ''Exposure Quantification'', aims to determine the amount of a contaminant (dose) that individuals and populations will receive, either as a contact level (e.g., concentration in ambient air) or as intake (e.g., daily dose ingested from drinking water). This is done by examining the results of the discipline of [[exposure assessment]]. As a different location, lifestyle, and other factors likely influence the amount of contaminant that is received, a range or distribution of possible values is generated in this step. Particular care is taken to determine the exposure of the susceptible population(s).

The results of these steps are combined to produce an estimate of risk. Because of the different susceptibilities and exposures, this risk will vary within a population. An uncertainty analysis is usually included in a health risk assessment.

== Dynamic risk assessment ==
During an emergency response, the situation and hazards are often inherently less predictable than for planned activities (non-linear). In general, if the situation and hazards are predictable (linear), standard operating procedures should deal with them adequately. In some emergencies, this may also hold true, with the preparation and trained responses being adequate to manage the situation. In these situations, the operator can manage risk without outside assistance, or with the assistance of a backup team who are prepared and available to step in at short notice.

Other emergencies occur where there is no previously planned protocol, or when an outsider group is brought in to handle the situation, and they are not specifically prepared for the scenario that exists but must deal with it without undue delay. Examples include police, fire department, disaster response, and other public service rescue teams. In these cases, ongoing risk assessment by the involved personnel can advise appropriate action to reduce risk.<ref name="Lock 2017" /> HM Fire Services Inspectorate has defined dynamic risk assessment (DRA) as:

{{blockquote|The continuous assessment of risk in the rapidly changing circumstances of an operational incident, in order to implement the control measures necessary to ensure an acceptable level of safety.<ref name="Lock 2017">{{cite journal| vauthors = Lock G | veditors = Phillips M |title=Public Safety Diving-Dynamic Risk Assessment|journal=PS Diver Magazine|date=June 2017|issue=116|page=9|url=http://psdiver.com/images/PSDiver_Issue_116_-_SECURE.pdf|access-date=20 June 2017}}</ref>}}

Dynamic risk assessment is the final stage of an integrated safety management system that can provide an appropriate response during changing circumstances. It relies on experience, training and continuing education, including effective debriefing to analyse not only what went wrong, but also what went right, and why, and to share this with other members of the team and the personnel responsible for the planning level risk assessment.<ref name="Lock 2017" />

==Fields of application==
The application of risk assessment procedures is common in a wide range of fields, and these may have specific legal obligations, codes of practice, and standardised procedures. Some of these are listed here.

=== General human health ===
There are many resources that provide human health risk information:

The [[National Library of Medicine]] provides risk assessment and regulation information tools for a varied audience.<ref>{{cite web|title=Risk Assessment and Regulation Information from the NLM |url= http://sis.nlm.nih.gov/enviro/riskinformation.html |publisher=[[National Library of Medicine]] |access-date=9 June 2013}}</ref> These include:
* TOXNET (databases on hazardous chemicals, environmental health, and toxic releases),<ref>{{cite web|title=Databases on toxicology, hazardous chemicals, environmental health, and toxic releases|url=http://toxnet.nlm.nih.gov|work=TOXNET|publisher=[[National Library of Medicine|NLM]]|access-date=9 June 2013|date=May 2012}}</ref>
* the Household Products Database (potential health effects of chemicals in over 10,000 common household products),<ref>{{cite web|title=Household Products Database|url=http://hpd.nlm.nih.gov/|publisher=U.S. Dept. of Health & Human Services|access-date=9 June 2013|date=January 2013}}</ref>
* [[TOXMAP]] (maps of the [[Superfund|U.S. Environmental Protection Agency Superfund]] and [[Toxics Release Inventory]] data).

The [[United States Environmental Protection Agency]] provides basic information about environmental health risk assessments for the public for a wide variety of possible environmental exposures.<ref>{{cite web|title=Risk Assessment Portal|url=http://www.epa.gov/risk/|publisher=[[United States Environmental Protection Agency|EPA]]|access-date=9 June 2013|date=13 May 2013}}</ref>

The Environmental Protection Agency began actively using risk assessment methods to protect drinking water in the United States after the passage of the Safe Drinking Water Act of 1974. The law required the National Academy of Sciences to conduct a study on drinking water issues, and in its report, the NAS described some methodologies for doing risk assessments for chemicals that were suspected carcinogens, recommendations that top EPA officials have described as perhaps the study's most important part.<ref>EPA Alumni Association: Senior EPA officials discuss early implementation of the Safe Drinking Water Act of 1974, [http://www.epaalumni.org/history/video/interview.cfm?id=13 Video], [http://www.epaalumni.org/userdata/pdf/6014106B36AE81EB.pdf#page=11 Transcript] (see pages 11,14).</ref>

Considering the increase in junk food and its toxicity, FDA required in 1973 that cancer-causing compounds must not be present in meat at concentrations that would cause a cancer risk greater than 1 in a million over a lifetime. The US Environmental Protection Agency provides extensive information about ecological and environmental risk assessments for the public via its risk assessment portal.<ref>{{Cite web|url=http://www.epa.gov/risk/|title=Risk Assessment |publisher=US Environmental Protection Agency |website=www.epa.gov|language=en|access-date=2016-04-07|date=2013-09-26 }}</ref> The [[Stockholm Convention]] on [[persistent organic pollutants]] (POPs) supports a qualitative risk framework for public health protection from chemicals that display environmental and biological persistence, [[bioaccumulation]], toxicity (PBT) and long range transport; most global chemicals that meet this criterion have been previously assessed quantitatively by national and international health agencies.<ref>{{cite book |vauthors=Szabo DT, Loccisano AE |chapter=POPs and Human Health Risk Assessment |title=Dioxins and Persistent Organic Pollutants |edition=3rd |pages=579–618|date=March 30, 2012| doi=10.1002/9781118184141.ch19 |isbn=9781118184141}}</ref>

For non-cancer health effects, the terms [[reference dose]] (RfD)   or [[reference concentration]] (RfC) are used to describe the safe level of exposure in a dichotomous fashion. Newer ways of communicating the risk is the [[probabilistic risk assessment]].<ref>{{cite journal | vauthors = Nielsen GH, Heiger-Bernays WJ, Levy JI, White RF, Axelrad DA, Lam J, Chartres N, Abrahamsson DP, Rayasam SD, Shaffer RM, Zeise L, Woodruff TJ, Ginsberg GL | display-authors = 6 | title = Application of probabilistic methods to address variability and uncertainty in estimating risks for non-cancer health effects | journal = Environmental Health | volume = 21 | issue = Suppl 1 | pages = 129 | date = January 2023 | pmid = 36635712 | pmc = 9835218 | doi = 10.1186/s12940-022-00918-z | doi-access = free | bibcode = 2023EnvHe..21S.129N }}</ref>

==== Small sub-populations ====
When risks apply mainly to small sub-populations, it can be difficult to determine when intervention is necessary. For example, there may be a risk that is very low for everyone, other than 0.1% of the population. It is necessary to determine whether this 0.1% is represented by:
* all infants younger than ''X'' days or
* recreational users of a particular product.

If the risk is higher for a particular sub-population because of abnormal exposure rather than susceptibility, strategies to further reduce the exposure of that subgroup are considered.  If an identifiable sub-population is more susceptible due to inherent genetic or other factors, public policy choices must be made. The choices are:
* to set policies for protecting the general population that are protective of such groups, e.g. for children when data exists, the Clean Air Act for populations such as asthmatics or
* not to set policies, because the group is too small, or the costs too high.

==== Acceptable risk criteria ====
{{Redirect|Acceptable risk|the television show|Acceptable Risk (TV series)|the book|Acceptable Risk (novel)}}

Acceptable risk is a risk that is understood and tolerated usually because the cost or difficulty of implementing an effective countermeasure for the associated vulnerability exceeds the expectation of loss.{{Ref RFC|4949|notes=no}}

The idea of not increasing lifetime risk by more than one in a million has become commonplace in public health discourse and policy.<ref>{{cite web|url=https://www.who.int/water_sanitation_health/dwq/iwachap10.pdf|title=Acceptable Risk| vauthors = Hunter PR, Fewtrell L |publisher=[[World Health Organization]]|date=2001}}</ref> It is a heuristic measure. It provides a numerical basis for establishing a negligible increase in risk.

Environmental decision making allows some discretion for deeming individual risks potentially "acceptable" if less than one in ten thousand chance of increased lifetime risk. Low risk criteria such as these provide some protection for a case where individuals may be exposed to multiple chemicals e.g. pollutants, food additives, or other chemicals.{{cn|date=March 2023}}

In practice, a true zero-risk is possible only with the suppression of the risk-causing activity.{{cn|date=March 2023}}

Stringent requirements of 1 in a million may not be technologically feasible or may be so prohibitively expensive as to render the risk-causing activity unsustainable, resulting in the optimal degree of intervention being a balance between risks vs. benefit.{{cn|date=March 2023}} For example, emissions from hospital incinerators result in a certain number of deaths per year. However, this risk must be balanced against the alternatives.  There are public health risks, as well as economic costs, associated with all options. The risk associated with no [[incineration]] is the potential spread of infectious diseases or even no hospitals. Further investigation identifies options such as separating noninfectious from infectious wastes, or air pollution controls on a medical incinerator.

Intelligent thought about a reasonably full set of options is essential.  Thus, it is not unusual for there to be an iterative process between analysis, consideration of options, and follow up analysis.{{cn|date=March 2023}}

=== Public health ===
In the context of [[public health]], risk assessment is the process of characterizing the nature and likelihood of a harmful effect to individuals or populations from certain human activities. Health risk assessment can be mostly qualitative or can include statistical estimates of probabilities for specific populations. In most countries, the use of specific chemicals or the operations of specific facilities (e.g. power plants, manufacturing plants) is not allowed unless it can be shown that they do not increase the risk of death or illness above a specific threshold. For example, the American [[Food and Drug Administration]] (FDA) regulates food safety through risk assessment, while the [[EFSA]] does the same in EU.<ref name="pmid9143722">{{cite journal | vauthors = Merrill RA | title = Food safety regulation: reforming the Delaney Clause | journal = Annual Review of Public Health | volume = 18 | pages = 313–40 | date = 1997 | pmid = 9143722 | doi = 10.1146/annurev.publhealth.18.1.313|doi-access=free }} This source includes a useful historical survey of prior food safety regulation.</ref>

An [[occupational risk assessment]] is an evaluation of how much potential danger a [[hazard]] can have to a person in a workplace environment. The assessment takes into account possible scenarios in addition to the probability of their occurrence and the results.<ref name="NIOSH practices">{{Cite report|date=2020-02-01|title=Current intelligence bulletin 69: NIOSH practices in occupational risk assessment.|url=https://www.cdc.gov/niosh/docs/2020-106/|language=en|doi=10.26616/nioshpub2020106|doi-access=free}}</ref> The <u>six</u> types of hazards to be aware of are safety (those that can cause injury), [[Chemical hazard|chemicals]], [[Biological hazard|biological]], [[Physical hazard|physical]], <u>psychosocial</u> <u>(those that cause stress, harassment</u>) and [[Ergonomic hazard|ergonomic]] (those that can cause [[musculoskeletal disorder]]s).<ref>{{Cite web |title=OSHA's 5 Workplace Hazards|url=http://www.grainger.com/know-how/safety/safety-management/safety-compliance/kh-five-workplace-hazards|website=Grainger Industrial Supply}}</ref> To appropriately access hazards there are two parts that must occur. Firstly, there must be an "[[exposure assessment]]" which measures the likelihood of worker contact and the level of contact. Secondly, a "risk characterization" must be made which measures the probability and severity of the possible health risks.<ref name="Waters etal 2015">{{cite journal | vauthors=Waters M, McKernan L, Maier A, Jayjock M, Schaeffer V, Brosseau L | title=Exposure Estimation and Interpretation of Occupational Risk: Enhanced Information for the Occupational Risk Manager | journal=Journal of Occupational and Environmental Hygiene | volume=12 |issue=Suppl 1 | pages=S99-111 | date=2015-11-25 | pmid=26302336 | pmc=4685553 | doi=10.1080/15459624.2015.1084421 }}</ref>


=== Human settlements ===
The importance of risk assessments to manage the [[effects of climate change|consequences of climate change]] and variability is recalled in the global frameworks for [[disaster risk reduction]], adopted by the member countries of the United Nations at the end of the World Conferences held in Kobe (2005) and Sendai (2015). The [[Sendai Framework for Disaster Risk Reduction]] brings attention to the local scale and encourages a holistic risk approach, which should consider all the hazards to which a community is exposed, the integration of technical-scientific knowledge with local knowledge, and the inclusion of the concept of risk in local plans to achieve a significant disaster reduction by 2030. Taking these principles into daily practice poses a challenge for many countries. The Sendai framework monitoring system highlights how little is known about the progress made from 2015 to 2019 in local disaster risk reduction.<ref>{{cite book |last1=UNDRR |title=Global Assessment Report on Disaster Risk Reduction |date=2019 |publisher=UNDRR |location=Geneva |isbn=978-92-1-004180-5 |pages=472 |url=https://gar.unisdr.org |access-date=22 June 2020}}</ref>

==== Sub-Saharan Africa ====
As of 2019, in the South of the Sahara, risk assessment is not yet an institutionalized practice. The exposure of human settlements to multiple hazards (hydrological and agricultural drought, pluvial, fluvial and coastal floods) is frequent and requires risk assessments on a regional, municipal, and sometimes individual human settlement scale. The multidisciplinary approach and the integration of local and technical-scientific knowledge are necessary from the first steps of the assessment. Local knowledge remains unavoidable to understand the hazards that threaten individual communities, the critical thresholds in which they turn into disasters, for the validation of [[hydraulic model]]s, and in the decision-making process on [[disaster risk reduction|risk reduction]]. On the other hand, local knowledge alone is not enough to understand the impacts of future changes and climatic variability and to know the areas exposed to infrequent hazards.
The availability of new technologies and [[open access]] information (high resolution satellite images, daily rainfall data) allow assessment today with an accuracy that only 10 years ago was unimaginable. The images taken by unmanned vehicle technologies allow to produce very high resolution digital elevation models and to accurately identify the receptors.<ref>{{cite journal | vauthors = Tiepolo M |title=Flood Assessment for Risk-Informed Planning along the Sirba River, Niger |journal=Sustainability |date=2019 |volume=11 |issue=4003 |doi=10.3390/w11051018 |doi-access=free }}</ref> Based on this information, the hydraulic models allow the identification of flood areas with precision even at the scale of small settlements.<ref>{{cite journal | vauthors = Massazza G | title=Flood Hazard Scenarios of the Sirba River (Niger): Evaluation of the Hazard Thresholds and Flooding Areas |journal=Water |date=2019 |volume=11 |issue=5 |page=1018 |doi=10.3390/w11051018 |doi-access=free }}</ref> The information on loss and damages and on cereal crop at individual settlement scale allow to determine the level of multi-hazard risk on a regional scale.The multi-temporal high-resolution satellite images allow to assess the hydrological drought and the dynamics of human settlements in the flood zone.<ref>{{cite journal | vauthors = Tiepolo M |title=Multihazard Risk Assessment for Planning with Climate in the Dosso Region, Niger |journal=Climate |date=2018 |volume=6 |issue=67 |page=67 |doi=10.3390/cli6030067 |bibcode=2018Clim....6...67T |doi-access=free }}</ref>
Risk assessment is more than an aid to informed decision making about risk reduction or acceptance.<ref>{{cite web |last1=International Organization for Standardization |title=ISO Guide 73: 2009. Risk management – Vocabulary |url=https://www.iso.org/standard/44651.html |website=ISO |date=8 November 2017 |access-date=22 June 2020}}</ref> It integrates early warning systems by highlighting the hot spots where disaster prevention and preparedness are most urgent.<ref name = "Tarchiani_2020">{{cite journal | vauthors = Tarchiani V |title=Community and Impact Based Early Warning System for Flood Risk Preparedness: The Experience of the Sirba River in Niger |journal=Sustainability |date=2020 |volume=12 |issue=2196 |doi=10.3390/su12062196 |doi-access=free }}</ref> When risk assessment considers the dynamics of exposure over time, it helps to identify risk reduction policies that are more appropriate to the local context.
Despite these potentials, the risk assessment is not yet integrated into the local planning in the South of the Sahara which, in the best of cases, uses only the analysis of [[Climate change vulnerability|vulnerability to climate change]] and variability.<ref name = "Tarchiani_2020" />

===Auditing===
For audits performed by an outside audit firm, risk assessment is a crucial stage before accepting an audit engagement. According to ISA315 ''Understanding the Entity and its Environment and Assessing the Risks of Material Misstatement'', "the auditor should perform risk assessment procedures to obtain an understanding of the entity and its environment, including its internal control". Evidence relating to the auditor's risk assessment of a material misstatement in the client's financial statements. Then, the auditor obtains initial evidence regarding the classes of transactions at the client and the operating effectiveness of the client's internal controls. Audit risk is defined as the risk that the auditor will issue a clean unmodified opinion regarding the financial statements, when in fact the financial statements are materially misstated, and therefore do not qualify for a clean unmodified opinion. As a formula, audit risk is the product of two other risks: Risk of Material Misstatement and Detection Risk. This formula can be further broken down as follows:  [[inherent risk]] × [[control risk]] × [[detection risk]].

===Project management===
In [[project management]], risk assessment is an integral part of the risk management plan, studying the probability, the impact, and the effect of every known risk on the project, as well as the corrective action to take should an incident be implied by a risk occur.<ref>[http://www.pmhut.com/managing-project-risks Managing Project Risks] - Retrieved May 20th, 2010</ref> Of special consideration in this area are the relevant codes of practice that are enforced in the specific jurisdiction. Understanding the regime of regulations that risk management must abide by is integral to formulating safe and compliant risk assessment practices.

=== Information security ===
{{Main|IT risk management#Risk assessment}}

[[IT risk|Information technology risk]] assessment can be performed by a qualitative or quantitative approach, following different methodologies. One important difference{{clarify|reason=difference from what?|date=June 2017}} in risk assessments in [[information security]] is modifying the threat model to account for the fact that any adversarial system connected to the Internet has access to threaten any other connected system.<ref>{{Cite book|chapter=Global adversarial capability modeling|title=2015 APWG Symposium on Electronic Crime Research (eCrime)|date=2015-05-01|pages=1–21|doi=10.1109/ECRIME.2015.7120797| vauthors=Spring J, Kern S, Summers A |isbn=978-1-4799-8909-6|s2cid=24580989}}</ref> Risk assessments may therefore need to be modified to account for the threats from all adversaries, instead of just those with reasonable access as is done in other fields.

'''NIST Definition:''' The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system. Part of risk management incorporates threat and vulnerability analyses and considers mitigations provided by security controls planned or in place.<ref>{{Cite web |title = Risk assessment|  work = NIST Computer Security Resource Center Glossary|url=https://csrc.nist.gov/glossary/term/risk_assessment | publisher = National Institute of Standards and Technology (NIST) }}</ref>

There are various risk assessment methodologies and frameworks available which include NIST Risk Management Framework (RMF),<ref>{{Cite web |title=NIST |url=https://csrc.nist.gov/projects/risk-management |website=NIST|date=30 November 2016 }}</ref> Control Objectives for Information and Related Technologies (COBIT),<ref>{{Cite web |title=ISACA COBIT |url=https://www.isaca.org/resources/cobit |website=ISACA}}</ref> Factor Analysis of Information Risk (FAIR),<ref>{{Cite web |title=FAIR |url=https://www.fairinstitute.org/fair-risk-management |website=FAIR}}</ref> Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE),<ref>{{Cite web |title=Carnegie Mellon University |url=https://insights.sei.cmu.edu/library/operationally-critical-threat-asset-and-vulnerability-evaluation-octave-framework-version-10/ |website=Software Engineering Institute, Carnegie Mellon University|date=31 August 1999 }}</ref> The Center for Internet Security Risk Assessment Method (CIS RAM),<ref>{{Cite web |title=Center for Internet Security |url=https://learn.cisecurity.org/cis-ram?_gl=1*k8e0uo*_ga*MTcwNTU0MTE1MS4xNjk5NDU5NDYz*_ga_3FW1B1JC98*MTY5OTQ3NzI2My4yLjAuMTY5OTQ3NzI2My4wLjAuMA..*_ga_N70Z2MKMD7*MTY5OTQ3NzI2My4yLjAuMTY5OTQ3NzI2My42MC4wLjA. |website=Center for Internet Security (CIS)}}</ref> and The Duty of Care Risk Analysis (DoCRA) Standard,<ref>{{Cite web |title=DoCRA |url=https://www.docra.org/ |website=Duty of Care Risk Analysis (DoCRA)}}</ref> which helps define 'reasonable' security.

=== Cybersecurity ===
{{main|cybersecurity}}
The Threat and Risk Assessment (TRA) process is part of risk management referring to risks related to [[cyber threat]]s. The TRA process will identify cyber risks, assess risks' severities, and may recommend activities to reduce risks to an acceptable level.

There are different methodologies for performing TRA (e.g., Harmonized TRA Methodology<ref>{{Cite web | author = Canadian Centre for Cyber Security|date=2018-08-15|title=Canadian Centre for Cyber Security|url=https://cyber.gc.ca/en/guidance/harmonized-tra-methodology-tra-1|access-date=2021-08-09|website=Canadian Centre for Cyber Security}}</ref>), all utilize the following elements:<ref>{{cite book | vauthors = Baingo D | chapter = Threat Risk Assessment (TRA) for Physical Security|date=2021 | title = Sensemaking for Security|pages=243–270| veditors = Masys AJ |series=Advanced Sciences and Technologies for Security Applications|place=Cham|publisher=Springer International Publishing |language=en |doi=10.1007/978-3-030-71998-2_14 |isbn=978-3-030-71998-2|s2cid=236706551 }}</ref><ref>{{Cite web|title=An Overview of Threat and Risk Assessment {{!}} SANS Institute|url=https://www.sans.org/white-papers/76/|access-date=2021-08-09|website=www.sans.org}}</ref><ref>{{Cite web | author = Treasury Board of Canada Secretariat|date=2006-03-06|title=Rescinded [2019-06-28] - Security Organization and Administration Standard|url=https://www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=12333|access-date=2021-08-09|website=www.tbs-sct.gc.ca}}</ref> identifying of assets (what should be protected), identifying and assessing of the threats and vulnerabilities for the identified assets, determining the exploitability of the vulnerabilities, determining the levels of risk associated with the vulnerabilities (what are the implications if the assets were damaged or lost), and recommending a risk mitigation program.

=== Megainvestment projects ===
[[Megaprojects]] (sometimes also called "major programs") are extremely large-scale investment projects, typically costing more than US$1 billion per project. They include bridges, tunnels, highways, railways, airports, seaports, power plants, dams, wastewater projects, coastal flood protection, [[oil extraction|oil]] and [[natural gas extraction]] projects, public buildings, information technology systems, aerospace projects, and defence systems. Megaprojects have been shown to be particularly risky in terms of finance, safety, and social and [[environmental impact]]s.

=== Software evolution ===
Studies have shown that early parts of the system development cycle such as requirements and design specifications are especially prone to error. This effect is particularly notorious in projects involving multiple [[Project stakeholder|stakeholders]] with different points of view. Evolutionary software processes offer an iterative approach to [[Requirements engineering|requirement engineering]] to alleviate the problems of uncertainty, ambiguity, and inconsistency inherent in software developments, including uncertainty, ambiguity, and inconsistency inherent in software developments.{{clarify|reason=What does this have to do with risk assessment?|date=June 2017}}

=== Shipping industry ===
In July 2010, shipping companies agreed to use standardized procedures in order to assess risk in key shipboard operations. These procedures were implemented as part of the amended [[International Safety Management Code|ISM Code]].<ref>{{cite web|title=ISM CODE – Amendments from 1st July 2010 Risk Assessment |url=http://www1.veristar.com/veristar/dps_info.nsf/veristar/Dps_info.nsf/AllByDateInternal/353FC02A22D59873C1257734003EC51C?opendocument | archive-url = https://web.archive.org/web/20140427010335/http://www1.veristar.com/veristar/dps_info.nsf/veristar/Dps_info.nsf/AllByDateInternal/353FC02A22D59873C1257734003EC51C?opendocument | archive-date = 27 April 2014 }}</ref>

=== Underwater diving ===
{{see also|List of diving hazards and precautions}}
Formal risk assessment is a required component of most [[Professional diving|professional dive planning]], but the format and methodology may vary. Consequences of an incident due to an identified hazard are generally chosen from a small number of standardised categories, and probability is estimated based on statistical data on the rare occasions when it is available, and on a best guess estimate based on personal experience and company policy in most cases. A simple [[risk matrix]] is often used to transform these inputs into a level of risk, generally expressed as unacceptable, marginal or acceptable. If unacceptable, measures must be taken to reduce the risk to an acceptable level, and the outcome of the risk assessment must be accepted by the affected parties before a dive commences. Higher levels of risk may be acceptable in special circumstances, such as military or search and rescue operations when there is a chance of recovering a survivor. [[Diving supervisor]]s are trained in the procedures of [[hazard identification and risk assessment]], and it is part of their planning and operational responsibility. Both health and safety hazards must be considered. Several stages may be identified. There is risk assessment done as part of the diving project planning, on site risk assessment which takes into account the specific conditions of the day, and [[dynamic risk assessment]] which is ongoing during the operation by the members of the dive team, particularly the supervisor and the working diver.<ref name="SA Diving Regulations 2009">{{cite web |title=Diving Regulations 2009 |work=Occupational Health and Safety Act 85 of 1993 – Regulations and Notices – Government Notice R41 |url=http://www.saflii.org/za/legis/consol_reg/ohasa85o1993rangnr41716/ |publisher=Government Printer |location=Pretoria |via=Southern African Legal Information Institute |access-date=3 November 2016 |url-status=dead |archive-url=https://web.archive.org/web/20161104080007/http://www.saflii.org/za/legis/consol_reg/ohasa85o1993rangnr41716/ |archive-date=4 November 2016 }}</ref><ref name="IMCA D022 2016">{{cite book|last=Staff|title=Guidance for diving supervisors IMCA D 022|edition=Revision 1|date=August 2016|publisher=International Marine Contractors Association|location=London, UK|pages=15{{hyphen}}5|chapter=15 - General safety requirements}}</ref>

In [[recreational scuba diving]], the extent of risk assessment expected of the diver is relatively basic and is included in the [[Buddy check|pre-dive checks]]. Several mnemonics have been developed by [[diver certification agencies]] to remind the diver to pay some attention to risk, but the training is rudimentary. Diving service providers are expected to provide a higher level of care for their customers, and [[diving instructor]]s and [[divemaster]]s are expected to assess risk on behalf of their customers and warn them of site-specific hazards and the competence considered appropriate for the planned dive. Technical divers are expected to make a more thorough assessment of risk, but as they will be making an informed choice for a recreational activity, the level of acceptable risk may be considerably higher than that permitted for occupational divers under the direction of an employer.<ref name="Diving at Work Regulations 1997" >{{cite web |url=http://www.legislation.gov.uk/uksi/1997/2776/made |title=The Diving at Work Regulations 1997 |last=Staff |year=1977 |work=Statutory Instruments 1997 No. 2776 Health and Safety |publisher=Her Majesty's Stationery Office (HMSO) |location=Kew, Richmond, Surrey |access-date=6 November 2016}}</ref><ref name="Gurr 2008">{{cite book| vauthors = Gurr K | veditors = Mount T, Dituri J |title=Exploration and Mixed Gas Diving Encyclopedia|edition=1st|date=August 2008|publisher=International Association of Nitrox Divers|location=Miami Shores, Florida|isbn=978-0-915539-10-9|pages=165–180|chapter=13: Operational Safety}}</ref>

===Outdoor and wilderness adventure===
In outdoor activities including commercial outdoor education, wilderness expeditions, and [[outdoor recreation]], risk assessment refers to the analysis of the probability and magnitude of unfavorable outcomes such as injury, illness, or property damage due to environmental and related causes, compared to the human development or other benefits of outdoor activity. This is of particular importance as school programs and others weigh the benefits of youth and adult participation in various outdoor learning activities against the inherent and other hazards present in those activities.  Schools, corporate entities seeking team-building experiences, parents/guardians, and others considering outdoor experiences expect or require<ref>{{cite web | title = 2018 Accreditation Rubric | url = https://www.nwais.org/uploaded/accreditation_resources/2018_Membership_AccredRubric.pdf | publisher = Northwest Association of Independent Schools | location = Seattle, Washington }}</ref> organizations to assess the hazards and risks of different outdoor activities—such as sailing, target shooting, hunting, mountaineering, or camping—and select activities with acceptable risk profiles.

Outdoor education, wilderness adventure, and other outdoor-related organizations should, and are in some jurisdictions required, to conduct risk assessments prior to offering programs for commercial purposes.<ref>{{cite web | url=http://www.supportadventure.co.nz/adventure-activities-regulations | title=Adventure Activities Regulations | work = supportadventure.co.nz }}</ref><ref>{{cite web | url=http://www.legislation.govt.nz/regulation/public/2016/0019/latest/DLM6725703.html | title=Health and Safety at Work (Adventure Activities) Regulations 2016 (LI 2016/19) | work = New Zealand Legislation }}</ref><ref>{{cite web | url=http://www.hse.gov.uk/aala/ | title=Adventure Activities Licensing | work = The Health and Safety Executive (HSE) | publisher = gov.uk }}</ref>

Such organizations are given guidance on how to provide their risk assessments.<ref>{{cite web | url=https://worksafe.govt.nz/topic-and-industry/adventure-activities | title=Adventure activities | work = Work Safe | location = New Zealand }}</ref>

Risk assessments for led outdoor activities form only one component of a comprehensive risk management plan, as many risk assessments use a basic linear-style thinking that does not employ more modern risk management practice employing complex socio-technical systems theory.<ref>{{Cite journal| vauthors = Dallat C, Salmon PM, Goode N |date=2015 |title=All about the Teacher, the Rain and the Backpack: The Lack of a Systems Approach to Risk Assessment in School Outdoor Education Programs|journal=Procedia Manufacturing|language=en|volume=3|pages=1157–1164|doi=10.1016/j.promfg.2015.07.193|doi-access=free}}</ref><ref>{{cite book | vauthors = Baierlein J |date=2019 |title=Risk Management for Outdoor Programs: a Guide to Safety in Outdoor Education, Recreation and Adventure |url=https://www.viristar.com/book |location=Seattle, WA |publisher=Viristar LLC}}</ref>

=== Environment ===
[[Environmental Risk Assessment]] (ERA) aims to assess the effects of stressors, usually chemicals, on the local environment. A risk is an integrated assessment of the likelihood and severity of an undesired event. In ERA, the undesired event often depends on the chemical of interest and on the risk assessment scenario.<ref name="Goussen et al 2016">{{cite journal | vauthors=Goussen B, Price OR, Rendal C, Ashauer R | title=Integrated presentation of ecological risk from multiple stressors | journal=Scientific Reports | volume=6 | pages=36004 | date=October 2016 | pmid=27782171 | pmc=5080554 | doi=10.1038/srep36004 | bibcode=2016NatSR...636004G }}</ref> This undesired event is usually a detrimental effect on organisms, populations or [[ecosystem]]s. Current ERAs usually compare an exposure to a no-effect level, such as the [[Predicted environmental concentration|Predicted Environmental Concentration]]/[[Predicted no-effect concentration|Predicted No-Effect Concentration]] (PEC/PNEC) ratio in Europe. Although this type of ratio is useful and often used in regulation purposes, it is only an indication of an exceeded apparent threshold.<ref>{{cite journal | vauthors=Jager T, Heugens EH, Kooijman SA | title=Making sense of ecotoxicological test results: towards application of process-based models | journal=Ecotoxicology | volume=15 | issue=3 | pages=305–14 | date=April 2006 | pmid=16739032 | doi=10.1007/s10646-006-0060-x | bibcode=2006Ecotx..15..305J | citeseerx=10.1.1.453.1811 | s2cid=18825042 }}</ref> New approaches start to be developed in ERA in order to quantify this risk and to communicate effectively on it with both the managers and the general public.<ref name="Goussen et al 2016" />

Ecological risk assessment is complicated by the fact that there are many nonchemical stressors that substantially influence ecosystems, communities, and individual plants and animals, as well as across landscapes and regions.<ref>{{cite journal | vauthors = Goussen B, Rendal C, Sheffield D, Butler E, Price OR, Ashauer R | title = Bioenergetics modelling to analyse and predict the joint effects of multiple stressors: Meta-analysis and model corroboration | journal = The Science of the Total Environment | volume = 749 | pages = 141509 | date = December 2020 | pmid = 32827825 | doi = 10.1016/j.scitotenv.2020.141509 | arxiv = 2102.13107 | doi-access = free | bibcode = 2020ScTEn.74941509G }}</ref><ref>{{Cite book|title=Regional scale ecological risk assessment : using the relative risk model|date=2005|publisher=CRC Press| vauthors = Landis WG |isbn=1-56670-655-6|location=Boca Raton, FL|oclc=74274833}}</ref>  Defining the undesired (adverse) event is a political or policy judgment, further complicating applying traditional risk analysis tools to ecological systems.  Much of the policy debate surrounding ecological risk assessment is over defining precisely what is an adverse event.<ref>{{cite journal | vauthors = Lackey R |title=If ecological risk assessment is the answer, what is the question |journal=Human and Ecological Risk Assessment |date=1997 |volume=3 |issue=6 |pages=921–928 |doi=10.1080/10807039709383735 |bibcode=1997HERA....3..921L }}</ref>

=== Biodiversity ===
Biodiversity Risk Assessments evaluate risks to [[biological diversity]], specially the risk of [[species]] [[extinction]] or the risk of [[ecosystem collapse]]. The units of assessments are the biological (species, [[subspecies]] or [[population]]s) or ecological entities ([[habitat]]s, [[ecosystem]]s, etc.), and the risk are often related to human actions and interventions (threats and pressures). Regional and national protocols have been proposed by multiple academic or governmental institutions and working groups,<ref name="NicholsonRegan2015">{{cite journal | vauthors=Nicholson E, Regan TJ, Auld TD, Burns EL, Chisholm LA, English V, Harris S, Harrison P, Kingsford RT, Leishman MR, Metcalfe DJ, Pisanu P, Watson CJ, White M, White MD, Williams RJ, Wilson B, Keith DA | display-authors=6 |title=Towards consistency, rigour and compatibility of risk assessments for ecosystems and ecological communities|journal=Austral Ecology|volume=40|issue=4|year=2015|pages=347–363|issn=1442-9985|doi=10.1111/aec.12148| bibcode=2015AusEc..40..347N |hdl=1885/66771| s2cid=82412136 |hdl-access=free}}</ref> but global standards such as the [[Red List of Threatened Species]] and the [[IUCN Red List of Ecosystems]] have been widely adopted, and are recognized or proposed as official indicators of progress toward international policy targets and goals, such as the [[Convention on Biological Diversity|Aichi targets]] and the [[Sustainable Development Goals]].<ref name="KeithRodríguez2015">{{cite journal | vauthors=Keith DA, Rodríguez JP, Brooks TM, Burgman MA, Barrow EG, Bland L, Comer PJ, Franklin J, Link J, McCarthy MA, Miller RM, Murray NJ, Nel J, Nicholson W, Oliveira-Miranda MA, Regan TJ, Rodríguez-Clark KM, Oliveira-Miranda MA, Regan TJ, Rouget M, Spalding MD | display-authors=6 |title=The IUCN Red List of Ecosystems: Motivations, Challenges, and Applications|journal=Conservation Letters|volume=8|issue=3|year=2015|pages=214–226|issn=1755-263X|doi=10.1111/conl.12167|doi-access=free| bibcode=2015ConL....8..214K |hdl=10536/DRO/DU:30073631|hdl-access=free}}</ref><ref name="BrooksButchart2015">{{cite journal| vauthors=Brooks TM, Butchart SH, Cox NA, Heath M, Hilton-Taylor C, Hoffmann M, Kingston N, Rodríguez JP, Stuart SN, Smart J | display-authors=6 |title=Harnessing biodiversity and conservation knowledge products to track the Aichi Targets and Sustainable Development Goals|journal=Biodiversity|volume=16|issue=2–3|year=2015|pages=157–174|issn=1488-8386|doi=10.1080/14888386.2015.1075903|doi-access=free| bibcode=2015Biodi..16..157B }}</ref>

=== Law ===
Risk assessments are used in numerous stages during the legal process and are developed to measure a wide variety of items, such as recidivism rates, potential pretrial issues, probation/parole, and to identify potential interventions for defendants.<ref name="What is Risk Assessment | Bureau of Justice Assistance">{{cite web | title = What is Risk Assessment | work = Bureau of Justice Assistance | publisher = U.S. Department of Justice | url = https://bja.ojp.gov/program/psrac/basics/what-is-risk-assessment }}</ref> Clinical psychologists, forensic psychologists, and other practitioners are responsible for conducting risk assessments.<ref name="What is Risk Assessment | Bureau of Justice Assistance" /><ref name="Monahan">{{cite journal | vauthors = Monahan J, Skeem JL | date = 2016 | title= Risk Assessment in Criminal Sentencing. | journal = Annual Review of Clinical Psychology | volume = 12 | pages = 489–513 | doi = 10.1146/annurev-clinpsy-021815-092945 | pmid = 26666966 | doi-access = free }}</ref><ref>{{cite journal | vauthors = Heilbrun K | date = 2009 | title = Risk Assessment in Evidence-Based Sentencing: Context and Promising Sues. | journal = Chapman Journal of Criminal Justice | volume = 1 | pages = 127–142 }}</ref> Depending on the risk assessment tool, practitioners are required to gather a variety of background information on the defendant or individual being assessed. This information includes their previous criminal history (if applicable) and other records (i.e. Demographics, Education, Job Status, Medical History), which can be accessed through direct interview with the defendant or on-file records.<ref name="What is Risk Assessment | Bureau of Justice Assistance" />

In the pre-trial stage, a widely used risk assessment tool is the Public Safety Assessment,<ref>{{cite web | title = Advancing Pretrial Policy & Research: What is the PSA? | url = https://advancingpretrial.org/psa/about/ | publisher = Advancing Pretrial Policy and Research (APPR) }}</ref> which predicts failure to appear in court, likelihood of a new criminal arrest while on pretrial release, and likelihood of a new violent criminal arrest while on pretrial release. Multiple items are observed and taken into account based on which aspect of the PSA is being focused, and like all other actuarial risk assessments, each item is assigned a weighted amount to produce a final score.<ref name="What is Risk Assessment | Bureau of Justice Assistance" /> Detailed information such as transparency on the items the PSA factors and how scores are distributed are accessible online.<ref>{{cite web | title = How the PSA Works | url = https://advancingpretrial.org/psa/factors/ | publisher = Advancing Pretrial Policy and Research (APPR) }}</ref>

For [[defendant]]s who have been incarcerated, risk assessments are used to determine their likelihood of [[recidivism]] and inform sentence length decisions. Risk assessments also aid parole/probation officers in determining the level of supervision a probationer should be subjected to and what interventions could be implemented to improve offender risk status.<ref name="Monahan" /> The [[COMPAS (software)|Correctional Offender Management Profiling for Alternative Sanctions]] (COMPAS) is a risk assessment too designed to measure pretrial release risk, general recidivism risk, and violent recidivism risk. Detailed information on scoring and algorithms for COMPAS are not accessible to the general public.

<!-- === Sustainable Heritage ===
Waiting for complete. -->

== See also ==
{{cmn|
* {{annotated link|Acceptable loss}}
* {{annotated link|Benefit shortfall}}
* {{annotated link|Control self-assessment}}
* {{annotated link|Cost overrun}}
* {{annotated link|Digital continuity}}
* {{annotated link|Duty of care}}
* {{annotated link|Edwards v National Coal Board}}
* {{annotated link|Extreme risk}}
* {{annotated link|Environmental impact assessment}}
* {{annotated link|Flood risk assessment}}
* {{annotated link|Form 696}}
* {{annotated link|Global catastrophic risk}}
* {{annotated link|Hazard analysis}}
* {{annotated link|Hazard analysis and critical control points|abbreviation=HACCP}} risk assessment in food
* {{annotated link|Health impact assessment}}
* {{annotated link|Horizon scanning}}
* {{annotated link|Information assurance}}
* {{annotated link|Index of auditing-related articles}}
* {{annotated link|ISO 28000}}
* {{annotated link|ISO 31000}}
* {{annotated link|ISSOW}}
* {{annotated link|Megaprojects and Risk|''Megaprojects and Risk''}}
* {{annotated link|Network theory in risk assessment}}
* {{annotated link|Occupational exposure banding}}
* {{annotated link|Optimism bias}}
* {{annotated link|PIMEX}} a video exposure monitoring method
* {{annotated link|Planning fallacy}}
* {{annotated link|Probabilistic risk assessment}}
* {{annotated link|Probit model}}
* {{annotated link|Project risk management}}
* {{annotated link|Reference class forecasting}}
* {{annotated link|Reliability engineering}}
* {{annotated link|Qualitative risk analysis|Risk assessment using qualifiers}}
* {{annotated link|Risk-based auditing}}
* {{annotated link|Risk management tools}}
* {{annotated link|Risk matrix}}
* {{annotated link|Safety engineering}}
* {{annotated link|Security risk}}
* {{annotated link|Statistical risk}}
* {{annotated link|Strategic misrepresentation}}
* [[Gordon–Loeb model]] for cyber security investments
}}

== References ==

=== References ===
{{reflist|30em}}

=== Further reading ===
{{refbegin|30em}}
* {{cite book| vauthors = Dorne JC, Kass GE, Bordajandi LR, Amzal B, Bertelsen U, Castoldi AF, Heppner C, Eskola M, Fabiansson S, Ferrari P, Scaravelli E, Dogliotti E, Fuerst P, Boobis AR, Verger P | display-authors = 6 |s2cid=24530234 |title=Metal Ions in Toxicology| veditors=Sigel A, Sigel H, Sigel RK |year=2011|publisher=RSC Publishing|pages=27–60|chapter=Chapter 2. Human Risk Assessment of Heavy Metals: Principles and Applications|doi=10.1039/9781849732116-00027|series=Metal Ions in Life Sciences |isbn=978-1-84973-091-4 }}
* {{cite book| vauthors=Mumtaz MM, Hansen H, Pohl HR | veditors=Sigel A, Sigel H, Sigel RK |title=Metal Ions in Toxicology|year=2011|publisher=RSC Publishing|pages=61–80|chapter=Chapter 3. Mixtures and Their Risk Assessment in Toxicology|doi=10.1039/9781849732116-00061|series=Metal Ions in Life Sciences |isbn=978-1-84973-091-4 }}
* {{citation |year=1994 |title=Science and judgment in risk assessment |author=Committee on Risk Assessment of Hazardous Air Pollutants |place=Washington, D.C. |publisher=[[National Academy Press]] |isbn=978-0-309-04894-1 |url=https://books.google.com/books?id=k9mKUyfHakcC&q=Science+and+judgment+in+risk+assessment |access-date=27 September 2010}}
* {{cite book | vauthors = Hallenbeck WH | title=Quantitative risk assessment for environmental and occupational health. | location=Chelsea, Mich. | publisher=Lewis Publishers | date=1986 }}
* {{cite book | veditors=Harremoës P | title=Late lessons from early warnings: the [[precautionary principle]] 1896–2000 }}
* {{cite book | vauthors = Lachin JM | title=Biostatistical methods: the assessment of relative risks }}
* {{cite book |year=2006 | vauthors=Lerche I, Glaesser W |title=Environmental risk assessment : quantitative measures, anthropogenic influences, human impact. |place=Berlin |publisher=Springer |isbn=978-3-540-26249-7 |url=https://books.google.com/books?id=qB54qgpA_fEC&q=Environmental+risk+assessment |access-date=27 September 2010}}
* {{cite magazine |date=November 26, 2006 | vauthors=Kluger J |author-link=Jeffrey Kluger |title=How Americans Are Living Dangerously |magazine=Time |url=http://www.time.com/time/magazine/article/0,9171,1562978,00.html |archive-url=https://web.archive.org/web/20061127232613/http://www.time.com/time/magazine/article/0,9171,1562978,00.html |url-status=dead |archive-date=November 27, 2006 |access-date=27 September 2010 }}  Also published as December 4 cover title: [https://web.archive.org/web/20061206030428/http://www.time.com/time/magazine/0%2C9263%2C7601061204%2C00.html "Why We Worry About the Wrong Things: The Psychology of Risk"] |work=Time
* {{cite report |year=1983 |title=A Review of risk assessment methodologies |publisher=[[Congressional Research Service]], Library of Congress, for the Subcommittee on Science, Research, and Technology |place=Washington: U.S }}
* {{cite book |year=1997 | vauthors=Mayo DG | chapter=Sociological versus metascientific views of technological risk assessment | veditors = Shrader-Frechette K, Westra L |title=Technology and values |place=Lanham, Maryland |publisher=Rowman & Littlefield |isbn=978-0-8476-8631-5 |url=https://books.google.com/books?id=y5BfvU6uMQMC&q=Technology+and+values |access-date=27 September 2010}}
* {{cite book | vauthors=Rozell DJ | date=2020 | title=Dangerous Science: Science Policy and Risk Analysis for Scientists and Engineers | location=London | publisher=Ubiquity Press | doi=10.5334/bci | isbn=978-1-911529-90-3 | s2cid=213952232 | doi-access=free }}
{{refend}}

<!-- == External links == -->
<!--========================({{No More Links}})============================
    | PLEASE BE CAUTIOUS IN ADDING MORE LINKS TO THIS ARTICLE. WIKIPEDIA  |
    | IS NOT A COLLECTION OF LINKS NOR SHOULD IT BE USED FOR ADVERTISING. |
    |                                                                     |
    |           Excessive or inappropriate links WILL BE DELETED.         |
    | See [[Wikipedia:External links]] & [[Wikipedia:Spam]] for details.  |
    |                                                                     |
    | If there are already plentiful links, please propose additions or   |
    | replacements on this article's discussion page, or submit your link |
    | to the relevant category at the Open Directory Project (dmoz.org)   |
    | and link back to that category using the {{dmoz}} template.         |
    =======================({{No More Links}})=============================-->

{{Risk management}}
{{Insurance}}
{{Occupational safety and health}}
{{Underwater diving|divsaf}}
{{Authority control}}

{{DEFAULTSORT:Risk Assessment}}
[[Category:Impact assessment]]
[[Category:Probability assessment]]
[[Category:Risk analysis|*]]
[[Category:Hazard analysis]]
[[Category:Safety engineering]]
[[Category:Reliability engineering]]
[[Category:Occupational safety and health]]
[[Category:Corporate development]]