Probability Times Impact — TechKnowSurge

About this interactive

The Risk Management lesson gives risk one equation: risk equals probability times impact. You can measure both sides in words: probability as rare, unlikely, possible, likely or certain, and impact as negligible, minor, moderate, major or severe. Or you can measure them in numbers: probability as the percent chance it happens, and impact as the dollar loss if it does. The numbers take more work to find, but they turn a risk into a dollar figure, which is what this activity practises. To calculate, turn the percent into a decimal and multiply. A 10% chance of a $30,000 loss is 0.10 × $30,000 = $3,000. The formula works backwards too. If a risk is $12,000 and its probability is 20%, the impact is $12,000 ÷ 0.20 = $60,000. If a risk is $9,000 and the impact is $45,000, the probability is $9,000 ÷ $45,000 = 0.20, or 20%. Dollar figures let you compare risks that feel different. A 5% chance of a $200,000 loss ($10,000) is a bigger risk than a 50% chance of a $10,000 loss ($5,000). They also show what a response is worth. A control that lowers the probability lowers the risk. Insurance transfers part of the impact to someone else, so the company carries only the part left over. Security+ writes the yearly version of the same idea as ALE = SLE × ARO, the loss from one event times how often it is expected in a year.

What you'll learn

Calculate a risk in dollars as probability times impact, with probability as a percent and impact as the dollar loss if it happens
Work the formula backwards to find a missing impact or probability, and compare two risks by their dollar values
Show how reducing probability or transferring part of the impact lowers the risk the company carries

Aligned to

CompTIA Security+

5.2 Explain elements of the risk management process.

Key terms

Risk: The potential for loss or harm resulting from a threat exploiting a vulnerability.
Probability: The likelihood that a specific threat event will occur, expressed as a qualitative rating or percentage.
Impact: The potential consequence or damage to an organization if a risk event occurs, expressed qualitatively or as a monetary value.
Quantitative Risk Analysis: A risk analysis method that assigns numerical values — such as probability percentages and monetary loss estimates — to risks in order to prioritize them and justify the cost of controls. It produces metrics like Single Loss Expectancy and Annualized Loss Expectancy.
Risk Register: A centralized document or database that tracks identified risks, their likelihood, potential impact, assigned owners, and planned response actions. The risk register is a core artifact of an organization's risk management program.

Topics

Risk Management Risk Assessment Interactive Calculation

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →