Very different approaches to risk management are taken in different fields, e.g. "Risk is the unwanted subset of a set of uncertain outcomes" (Cornelius Keating).
Risk can be seen as relating to the probability of uncertain future events.[5] For example, according to factor analysis of information risk, risk is:[5] the probable frequency and probable magnitude of future loss. In computer science this definition is used by The Open Group.[6]
OHSAS (Occupational Health & Safety Advisory Services) defines risk as the combination of the probability of a hazard resulting in an adverse event, times the severity of the event.[7]
In information security risk is defined as "the potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organization".[8]
Financial risk is often defined as the unpredictable variability or volatility of returns, and this would include both potential better-than-expected and worse-than-expected returns. References to negative risk below should be read as also applying to positive impacts or opportunity (e.g. for "loss" read "loss or gain") unless the context precludes this interpretation.
The related terms "threat" and "hazard" are often used to mean something that could cause harm.