In safety settings, understood as situations involving the potential occurrence of unintentional events, it is common to define risk as a combination of consequences and associated probabilities or associated uncertainties. On the other hand, in security settings, understood as situations involving the potential occurrence of intentional malicious events, risk is commonly defined as the triplet asset/value, threat and vulnerability. One motivation often mentioned for the latter is that probability is considered inappropriate for intentional acts. In this article, we argue that it is unsuitable and unnecessary to define risk differently in these two settings. We show that risk, defined as the combination of future consequences and associated uncertainties, can be seen as compatible with the triplet definition of security risk. It also excludes probability from the definition of risk but explicitly includes uncertainty, which is more fundamental and present regardless of the type of events involved. The value dimension is integrated with the consequences as these are with respect to something that humans value. The purpose of the article is to contribute to a consolidation of the safety and security risk management fields at the fundamental level.

No abstract

No abstract

This article presents a study of key foundational issues in relation to two methodologies developed and used for assessing national risk events in Norway and the Netherlands. Both these methodologies are, to a large extent, probability based, but there are considerable differences in the approaches adopted. The main aim of the article is to point to these differences and relate the methodologies to existing theories for risk conceptualisation and description. Neither of the two methodologies are able to create a strong conceptual platform for the risk assessment, largely because they fail to clearly define and relate the core concepts of risk, probability and uncertainty. The treatment of uncertainty is another problematic issue, and we argue that both methodologies, but especially the Norwegian one, suffer from a severe weakness: key aspects of uncertainty are not adequately reflected. Finally, we question the way the Dutch methodology has integrated value aspects into the risk assessment.

No abstract

No abstract