How is risk ranking quantified in ICRA?

How is risk ranking quantified in ICRA?

• A. Impact only
• B. Probability only
• C. Probability multiplied by impact
• D. Cost of controls

Answer: (C)

In ICRA, risk ranking is determined by combining how likely an event is with how severe the consequences would be if it occurred. By multiplying probability by impact, you get a single risk score that reflects both dimensions and allows you to compare and prioritize different risks. A scenario with high likelihood and high impact yields a high risk score, while a rare but severe event can still vary in risk depending on its probability. This approach ensures you don’t ignore either the chance of occurrence or the severity of outcomes. Using impact alone misses how often something could happen, while using probability alone misses how bad the consequence would be. Costs of controls relate to mitigation planning, not the magnitude of risk itself.

In ICRA, risk ranking is determined by combining how likely an event is with how severe the consequences would be if it occurred. By multiplying probability by impact, you get a single risk score that reflects both dimensions and allows you to compare and prioritize different risks. A scenario with high likelihood and high impact yields a high risk score, while a rare but severe event can still vary in risk depending on its probability. This approach ensures you don’t ignore either the chance of occurrence or the severity of outcomes.

Using impact alone misses how often something could happen, while using probability alone misses how bad the consequence would be. Costs of controls relate to mitigation planning, not the magnitude of risk itself.