'''风险'''是阻碍事物运动发展的客观存在，是事物发生与否的某种不确定性。事物的运动克服了风险阻碍则得到发展，受阻于风险则停止发展，甚至走向衰亡。从认知学上讲，风险的损害发生与否，损害的程度取决于人类主观认识和客观存在之间的差异性。在这个意义上说，风险指在一定条件下特定时期内，预期结果和实际结果之间的差异程度。
风险发生的可能性通常可以用概率进行测量。风险发生的概率在0－1之间波动。越接近1，风险发生的可能性越大，越接近0，风险发生的可能性越小。
风险的期望值为风险发生的概率与损失的乘积。

==风险的特征==

*客观可能性

风险是客观存在，虽然可以采用防范措施防止或降低风险发生导致的损失，但是不可能完全消除风险。

*偶然性

对于个别事件来看，风险导致事故的发生又有不确定性，不幸事件何时何地如何发生带来多大损失，有很大的偶然性，对于独立个体来说，事先难以确定。

*可测性

单个风险的发生虽然是偶然的，但是大量同质个体某一时期某种风险的发生又有其规律性。就大量风险单位而言，风险发生可以用概率加以测度。

==风险发生的因素==

风险发生的因素是指引起或增加损失频率和损失程度的条件。

*实质风险因素指对某一标的物增加风险发生机会或者导致严重损伤和伤亡的客观自然原因。如空气干燥是引起火灾的风险因素，地面断层是导致地震的风险因素。

*心理风险因素指由于心理的原因引起行为上的疏忽和过失，从而成为引起风险的发生原因。例如乱扔烟头容易引起火灾、酒后驾驶容易引起交通事故等。

*道德风险因素指人们的故意行为或者不作为。比如放火引起火灾、故意不履行合约引起经济损失等。

==风险发生的过程==

*风险形成

风险形成的过程是风险发生的因素不断组合的过程。

*风险发生

风险发生是风险因素不断组合、增加、成长所导致的结果。这个结果对于个体来说具有其偶然性，是不确定的，但是对于大量同质个体组成的总体而言，又有发生的总体趋势。

*风险损害

风险发生导致价值的丧失，称为风险损害。损害的内涵很广，包括物质上的损失和精神上的创伤等。

==风险的分类==

风险分类有多种方法，常用的有以下几种：

*按照风险险的性质划分
*#纯粹风险：只有损失机会而没有获利可能的风险。
*#投机风险：既有损失的机会也有获利可能的风险。
*按照产生风险的环境划分
*#静态风险：自然力的不规则变动或人们的过失行为导致的风险。
*#动态风险：社会、經濟、科技或政治變動产生的风险。
*按照风险发生的原因划分
*#自然风险：自然因素和物力现象所造成的风险。
*#社会风险：个人或团体在社会上的行为导致的风险。
*#经济风险：经济活动过程中，因市场因素影响或者管理经营不善导致经济损失的风险。
*按照风险致损的对象划分
*#财产风险：各种财产损毁、灭失或者贬值的风险。
*#人身风险：个人的疾病、意外伤害等造成残疾、死亡的风险。
*#责任风险：法律或者有关合同规定，因行为人的行为或不作为导致他人财产损失或人身伤亡，行为人所负经济赔偿责任的风险。

==风险相关概念==

===风险与危险===

我们经常会听到这样的说法：“投资股票的风险很大，但是高风险产生高回报”，“战争爆发的危险依然存在”等说法。风险与危险两者的相同点都是可能对行为主体发生损害，不同点在于，风险是抽象的概念，由多个因素构成，其结果导致损害，也可能导致获利；但是危险通常指一种具体的概念，其结果导致损害。保险公司经营的是风险，而不是危险。

'''Risk''' is a value that may arise from a future event, or we can say that "Risks are events or conditions that may occur, and whose occurrence, if it does take place, has a harmful or negative effect".   Exposure to the consequences of uncertainty constitutes a risk.
In everyday usage, ''risk'' is often used synonymously with the probability of a known loss.

Risk communication and risk perception are essential factors for  all human decision making.

==Definitions of risk==
There are many definitions of ''risk'' that vary by specific application and situational context.  One is that risk is an issue, which can be avoided or mitigated (wherein an issue is a potential problem that has to be fixed now.)
Risk is described both qualitatively and quantitatively. In some texts risk is described a situation in which would lead to negative consequences.

Qualitatively, risk is proportional to both the expected losses which may be caused by an event and to the probability of this event.  Greater loss and greater event likelihood result in a greater overall risk.

Frequently in the subject matter literature, ''risk'' is defined in pseudo-formal forms where the components of the definition are vague
and ill-defined, for example, ''risk'' is considered as an indicator of threat, or depends on threats, vulnerability, impact and uncertainty.

In engineering, the definition ''risk'' often simply is:

:<math> \text{Risk} = (\text{probability of an accident}) \times  (\text{losses per accident}).\, </math>

Or in more general terms:

:<math> \text{Risk} = (\text{probability of risk occurring}) \times  (\text{impact of risk occuring}).\, </math>

There are more sophisticated definitions, however. Measuring engineering risk is often difficult, especially in potentially dangerous industries such as nuclear energy.  Often, the probabilities for rare failures may be difficult to estimate if an event tree cannot be formulated.  Methods to calculate the cost of the loss of human life vary depending on the purpose of the calculation.  Specific methods include what people are willing to pay to insure against death<ref></ref>, and radiological release (e.g., GBq of radio-iodine).
There are many formal methods used to assess or to "measure" risk,  considered as one of the critical indicators important for human decision making.

volatility of returns and thus includes both potential worse-than-expected as well as better-than-expected returns. References to negative risk below should be read as applying to positive impacts or opportunity (e.g., for "loss" read "loss or gain") unless the context precludes.

In statistics, risk is often mapped to the probability of some event which is seen as undesirable. Usually, the probability of that event and some assessment of its expected harm must be combined into a believable scenario (an outcome), which combines the set of risk, regret and reward probabilities into an expected value for that outcome.  (See also Expected utility.)

Thus, in statistical decision theory, the risk function of an estimator ''δ(x)'' for a parameter ''θ'', calculated from some observables ''x'', is defined as the expectation value of the loss function ''L'',

:<math> R(\theta,\delta(x)) = \int L(\theta,\delta(x)) f(x|\theta)\,dx</math>

In information security , a ''risk'' is defined as a function of three variables:
#the probability that there is a threat
#the probability that there are any vulnerabilities
#the potential impact.

If any of these variables approaches zero, the overall risk approaches zero.

The management of actuarial risk is called risk management.

===Historical background===
U.S. and the USSR. It became widespread in insurance circles in the 1970s when major oil tanker disasters forced a more comprehensive foresight.  The scientific approach to risk entered finance in the 1980s when financial derivatives proliferated.  It reached general professions in the 1990s when the power of personal computing allowed for widespread data collection and numbers crunching.

Governments are apparently only now learning to use sophisticated risk methods, most obviously to set standards for environmental regulation, e.g. "pathway analysis" as practiced by the United States Environmental Protection Agency.

===Risk versus uncertainty===
In his seminal work ''Risk, Uncertainty, and Profit'', Frank Knight (1921) established the distinction between risk and uncertainty.

A solution to this ambiguity is proposed in "How to Measure Anything:Finding the Value of Intangibles in Business" by Doug Hubbard<ref>Douglas Hubbard "How to Measure Anything: Finding the Value of Intangibles in Business" pg. 46, John Wiley & Sons, 2007</ref>

::'''Uncertainty''': The lack of complete certainty, that is, the existence of more than one possibility.  The "true" outcome/state/result/value is not known.

::'''Measurement of uncertainty''': A set of probabilities assigned to a set of possibilities.  Example: "There is a 60% chance this market will double in five years"

::'''Risk''': A state of uncertainty where some of the possibilities involve a loss, catastrophe, or other undesirable outcome.

::'''Measurement of risk''': A set of possibilities each with quantified probabilities and quantified losses. Example: "There is a 40% chance the proposed oil well will be dry with a loss of $12 million in exploratory drilling costs".

In this sense, Hubbard uses the terms so that one may have uncertainty without risk but not risk without uncertainty.  We can be uncertain about the winner of a contest, but unless we have some personal stake in it, we have no risk.  If we bet money on the outcome of the contest, then we have a risk.  In both cases there are more than one outcome.  The measure of uncertainty refers only to the probabilities assigned to outcomes, while the measure of risk requires both probabilities for outcomes and losses quantified for outcomes.

==Insurance and health risk==
Insurance is a risk-reducing investment in which the buyer pays a small fixed amount to be protected from a potential large loss. Gambling is a risk-increasing investment, wherein money on hand is risked for a possible large return, but with the possibility of losing it all.  Purchasing a lottery ticket is a very risky investment with a high chance of no return and a small chance of a very high return.  In contrast, putting money in a bank at a defined rate of interest is a risk-averse action that gives a guaranteed return of a small gain and precludes other investments with possibly higher gain.

Risks in personal health may be reduced by primary prevention actions that decrease early causes of illness or by secondary prevention actions after a person has clearly measured clinical signs or symptoms recognized as risk factors. Tertiary prevention (medical) reduces the negative impact of an already established disease by restoring function and reducing disease-related complications. Ethical medical practice requires careful discussion of risk factors with individual patients to obtain informed consent for secondary and tertiary prevention efforts, whereas public health efforts in primary prevention require education of the entire population at risk. In each case, careful communication about risk factors, likely outcomes and certainty must distinguish between causal events that must be decreased and associated events that may be merely consequences rather than causes.

==Economic risk==
===Insight===

The central insight in the methodology for incorporating economic risks arise from the realization of the fact that however manifold and diverse might be the causes, or factors, of risks around a specific project or business (for instance, the hike in the price for raw materials, the lapsing of deadlines for construction of a new operating facility, disruptions in a production process, emergence of a serious competitor on the market, the loss of key personnel, the change of a political regime, natural contingencies, etc.), all of these are ultimately manifested under only two guises. According to CCF Conception the economic risk consists in that: '''''Actual positive conventional cash flows (income, inflows) turn out to be less than expected AND / OR Actual negative conventional cash flows (expenditures, outflows) turn out to be larger than expected (in absolute terms)'''''.

Such lucid and unambiguous conceptual treatment of such a complex and multi-faceted notion as the economic risk emphasizes the very core of the question.  The '''''economic risk is not an abstract ‘uncertainty’ or ‘possibility of failure’ or changeableness (variability) of the outcome… The economic risk – is a monetary amount which might be under-collected and/or over-paid.''''' Just as in music, one must use musical notes and staves—not alphabet letters or colors—to render a melody, in describing economic risk, we must ultimately operate with monetary units and not with the percentages of discount rates, magnitudes of volatility or anything else.
(See [http://ssrn.com/abstract=1012812].)

===In business===
Means of assessing risk vary widely between professions. Indeed, they may define these professions; for example, a doctor manages medical risk, while a civil engineer manages risk of structural failure. A professional code of ethics is usually focused on risk assessment and mitigation (by the professional on behalf of client, public, society or life in general).

In the workplace, incidental and inherent risks exist. Incidental risks are those which occur naturally in the business but are not part of the core of the business. Inherent risks have a negative effect on the operating profit of the business.

===Criticism===

Criticism has been leveled at the amoral ("rational") application of quantitative risk assessment. 

===Risk-sensitive industries===
Some industries manage risk in a highly quantified and numerate way. These include the aircraft industries, where the possible failure of a complex series of engineered systems could result in highly undesirable outcomes. The usual measure of risk for a class of events is then:

: ''R'' = probability of the event &times; ''C''

The total risk is then the sum of the individual class-risks.

In the nuclear industry, consequence is often measured in terms of off-site radiological release, and this is often banded into five or six decade-wide bands.
* Operational risk
* Safety engineering

The risks are evaluated using fault tree/event tree techniques (see safety engineering). Where these risks are low, they are normally considered to be "Broadly Acceptable". A higher level of risk (typically up to 10 to 100 times what is considered Broadly Acceptable) has to be justified against the costs of reducing it further and the possible benefits that make it tolerable—these risks are described as "Tolerable if ALARP". Risks beyond this level are classified as "Intolerable".

The level of risk deemed Broadly Acceptable has been considered by regulatory bodies in various countries—an early attempt by UK government regulator and academic F. R. Farmer used the example of hill-walking and similar activities which have definable risks that people appear to find acceptable. This resulted in the so-called Farmer Curve of acceptable probability of an event versus its consequence.

The technique as a whole is usually referred to as Probabilistic Risk Assessment (PRA) (or Probabilistic Safety Assessment, PSA). See WASH-1400 for an example of this approach.