Practical risk assessment with triangular distributions

Based on the familiar premise that risk is the product of two factors, probability and consequence (where the probability factor can be further decomposed into a threat factor and a vulnerability factor, if necessary), we determine the probability distribution of risk and show that there are four distinct parts to that distribution. We derive formulas for the probability density function and cumulative distribution function of risk, along with the expected value and variance of risk, assuming probability and consequence are independent. These results fully describe the risk, based only on the minimum value, maximum value and most likely value of each of the two risk factors. This offers a practical way to assess risk without extensive data collection or model development. Expressions for two different variability-related uncertainty measures, which we refer to as the variability interval and the vicinity of the mean, are also provided.