Capability is an important measure in adressing vulnerabilities and in assessing resilience. Is there a way to quantitatively describe what capability entails?
What is risk, and how can it be expressed? Different international standards, such as the AS/NZS 3460 Risk Management Standard, the COSO ERM framework and the ISO 31000 Risk Management Standard do not provide adequate guidance for risk assessments and lack the necessary precision.
The article lists and discusses eight risk definitions, and then suggests an alternative and comprehensive definition that captures all aspects of risk.
In this paper safety and security are brought together in a unifying risk and vulnerability framework that covers both accidental and malicious events.
It is only when the consequences of actions and events are uncertain that these actions and events are truly risky.
