What determines the level of risk?

Question

Options

• AThe cost of dealing with an adverse event if it occurs.
• BThe probability that an adverse event will occur.
• CThe amount of testing planned before release of a system.
• DThe likelihood of an adverse event and the impact of the event.

• A
  13% (4)
• B
  10% (3)
• C
  3% (1)
• D
  74% (23)

Explanation

Risk is defined by two factors working together: likelihood (probability) and impact (consequence). Option D captures this standard definition used across risk management frameworks (ISO 31000, ISTQB, PMI) - a high-probability event with trivial impact may be less concerning than a low-probability event with catastrophic impact.

• A is wrong because impact alone doesn't determine risk level; a costly event that's virtually impossible to occur may be a low risk overall.
• B is wrong for the same reason in reverse - high probability of a minor nuisance doesn't necessarily constitute high risk.
• C is wrong because testing quantity is a mitigation strategy, not a component of the risk definition itself.

Memory tip: Think of the classic risk formula - Risk = Likelihood × Impact. If either factor is zero, risk is zero; you need both to assess risk level. The word "and" in option D is your signal that it's combining both required elements.

No community discussion yet for this question.