Risk

• 1. Introduction

  ›

  Risk shapes nearly every decision a human being makes, yet the word itself was barely used in English before 1621. The Oxford English Dictionary traces the earliest appearance of "risque" - borrowed directly from French - to that year, with the modern spelling "risk" following in 1655. In the decades after, it spread through the worlds of trade, finance, and governance, filling a gap that older words like "hazard" could only partially cover. What began as a synonym for a source of harm slowly became something far more complex: a lens for understanding uncertainty itself.

  The questions risk raises are deceptively simple. How do you measure something that might never happen? How do you compare a small chance of catastrophe against a large chance of minor loss? And why do two people standing before the same danger often see it so differently? The answers pull in economists, psychologists, philosophers, engineers, and public health officials - each with their own definition, their own tools, and their own stakes.

• 2. A Word and Its Meanings

  ›

  Thomas Blount's "Glossographia" of 1661 defined risk as a synonym for hazard - a potential source of harm. That framing held for centuries. The first and second editions of the Oxford English Dictionary, published in 1914 and 1989, each kept it as the primary definition. Risk meant something that could hurt you.

  Samuel Johnson's "Dictionary of the English Language" in 1755 introduced a shift. Johnson's definition pointed toward the chance of harm rather than harm itself - not a thing, but a probability. That reorientation proved durable. Modern dictionaries followed: the Cambridge Advanced Learner's Dictionary defines risk simply as "the possibility of something bad happening."

  The institutional definitions that arrived in the twentieth century stretched the concept further. The Association for Project Management, in 1997, defined risk as "uncertain events affecting objectives." The UK Cabinet Office, in 2002, went further still, deliberately broadening the term to cover "positive opportunity or negative threat of actions and events." That move was intentional: the Cabinet Office wanted to encourage innovation in public services, and a purely negative definition of risk discouraged the upside. The International Organization for Standardization, in its ISO 31073 standard, landed on "effect of uncertainty on objectives" - a definition stripped of any assumption that consequences must be bad.

  The philosopher Frank Knight had already staked out the deepest distinction in his 1921 work "Risk, Uncertainty, and Profit." Knight argued that risk and uncertainty were categorically different things, not just degrees of the same thing. Risk, in his framing, was measurable - something you could attach a number to and calculate. Uncertainty was something else entirely: immeasurable, resistant to quantification, a fundamentally different animal. Knight's own words drew the line sharply: "a measurable uncertainty, or 'risk' proper, as we shall use the term, is so far different from an unmeasurable one that it is not in effect an uncertainty at all."

• 3. The Mathematics of the Unknown

  ›

  Kaplan and Garrick, writing in 1981, proposed that risk could be expressed as a set of triplets: a scenario, a probability for that scenario, and a consequence. Repeat that structure across every plausible scenario, and you have described a risk. Their formulation found its way into ISO Guide 73 and became a standard reference point for formal risk analysis.

  When consequences can be expressed in consistent units, the math can go further. Risk becomes a probability density function - a curve that describes the full spread of possible outcomes and their likelihoods. The tail of that curve is where the most dangerous outcomes live. Engineers and safety analysts sometimes focus specifically on the tail by plotting a complementary cumulative distribution function, often on logarithmic scales. Frequency-number diagrams, for instance, show how often in any given year a given number of fatalities might be exceeded.

  The most common shortcut is the expected value: probability multiplied by consequence, summed across all scenarios. It reduces a complex distribution to a single number. But that simplification carries a significant assumption. It presumes the decision-maker is risk-neutral - that a twenty percent chance of winning one million dollars feels exactly as desirable as receiving a certain two hundred thousand dollars. Most real decision-makers reject that equivalence. Pascal's mugging, a philosophical thought experiment, highlights the problem from the other direction: outcomes with vanishingly small probabilities but enormous consequences can produce absurdly large expected values, yet few would treat them as genuinely urgent.

  Benoit Mandelbrot drew a further distinction that the expected-value framework tends to obscure. Mandelbrot separated what he called "mild" risk from "wild" risk. Mild risk follows normal or near-normal probability distributions and behaves predictably over time - it regresses toward the mean and obeys the law of large numbers. Wild risk follows fat-tailed distributions, such as Pareto or power-law distributions. In the wild case, the mean or variance may be effectively infinite, making the law of large numbers invalid. Mandelbrot argued that treating wild risk as if it were mild was a fundamental and recurring error in risk assessment.

• 4. How the Mind Misreads Danger

  ›

  Paul Slovic's "psychometric paradigm" treats risk perception as something that can be measured through surveys. Slovic argues that intuitive emotional reactions are the dominant way humans evaluate risk - not calculation. His research suggests that purely statistical presentations of disasters fail to convey their true weight and fail to motivate protective action. Retrospective studies and evolutionary psychology have supported that position.

  The availability heuristic explains one of the most consistent distortions: people judge how likely an event is by how easily examples come to mind. Rare but dramatic causes of death get overestimated. Common, unglamorous causes get underestimated. The gap between the two is amplified by what researchers call an "availability cascade" - a self-reinforcing cycle in which media coverage of a minor event grows until the issue becomes politically significant, making examples even easier to recall and further inflating perceived risk.

  Decision theory adds another layer. The right prefrontal cortex, neuroscience research suggests, tends toward global perspectives, while greater left prefrontal activity correlates with local or focal processing. Bounded rationality means that extreme events with very low probabilities are often discounted because the probability is simply too low to grasp intuitively. One of the leading causes of road deaths - drunk driving - illustrates the problem: individual drivers tend to frame the decision by largely setting aside the risk of a serious or fatal accident.

  Cultural theory takes a collective view of risk perception. Different cultures select certain risks for attention while ignoring others, not because of miscalculation but as a way of maintaining their particular way of life. The theory uses two axes: the degree to which people are bound to social groups, and the degree of social regulation they accept. Cultural theory can explain why people with different worldviews struggle to agree on whether a hazard is acceptable, and why risk assessments persuade some audiences and not others. Evidence for the theory's predictive power, however, remains limited in quantitative terms.

• 5. Risk Before Numbers

  ›

  Peter Bernstein, writing in 2012, traced how merchants and investors made risk estimates long before statistics and probability theory existed. Captains and traders met at coffeehouses to compare voyage stories, sharing information about hazards on unfamiliar routes and the patterns of different seasons. A web of correspondents carried letters across long distances, updating beliefs about weather, wars, and piracy. These qualitative networks let underwriters and investors judge how dangerous a proposed voyage felt - without a formula in sight.

  That history led philosophers to ask a harder question: was this just primitive guesswork, or something legitimate in its own right? Ebert and colleagues, in a 2020 paper, drew a line between what they called risk monists and risk pluralists. Monists, among them Tversky and Kahneman, held that probability judgments which deviated from the mathematical rules of probability were simply wrong. Pluralists held that there were different valid notions of risk, and that pre-statistical methods of estimation might have been doing something genuinely reasonable - even if the answers sometimes conflicted with later statistical results.

  Two philosophical accounts of risk have emerged from this debate. The modal account holds that a situation is risky when nearby possible worlds - scenarios that differ only slightly from the actual one - contain serious harm. On this view, a low-probability disaster can still count as high risk if only a small change in circumstances would have produced it. The normic account holds that a situation is risky when the bad outcome would be normal or unsurprising given how the current setup tends to unfold. The less departure from normality required for harm, the greater the risk. In domains where predictive power is weak - suicide risk is one example the literature offers - the normic account allows analysts to reason about risk without needing to specify a probability.

• 6. Risk, Society, and Autonomy

  ›

  Anthony Giddens and Ulrich Beck drew a distinction that changed how sociologists thought about modern danger. Premodern societies faced risks - natural disasters, disease, famine - that were typically understood as external forces, acts of nature or of gods. Modern industrial societies, by contrast, generate risks that are products of the modernization process itself: pollution, chemical contamination, systemic financial failure. Giddens named these two categories external risks and manufactured risks. The term "risk society" was coined in the 1980s and gained wide currency through the 1990s, partly because it connected to growing environmental anxieties of that decade.

  The concept carries a practical edge in human services. John O'Brien put it directly: "People's autonomy used to be compromised by institution walls, now it's too often our risk management practices." The concern is that risk aversion in health, social care, and disability services has become a barrier to independence rather than a protection. Michael Fischer and Ewan Ferlie, writing in 2013, found that when formal risk controls collide with the emotional and ideological dimensions of human services work, the result can be sustained and sometimes irresolvable conflict.

  The international standard ISO 31000 sits at the center of formal organizational risk management today. It defines risk assessment in terms of three sequential steps: risk identification, risk analysis, and risk evaluation. The UK Health and Safety Executive developed the tolerability of risk framework, which divides risks into three bands. Unacceptable risks are permitted only in exceptional circumstances. Tolerable risks are kept as low as reasonably practicable - a principle abbreviated as ALARP - by weighing the costs and benefits of further reduction. Broadly acceptable risks require no further action. The ALARP principle, in particular, has spread well beyond its origins in British workplace safety into environmental regulation and critical infrastructure planning.