ARTICLE IN PRESS

Reliability Engineering and System Safety 95 (2010) 623–631

Contents lists available at ScienceDirect

Reliability Engineering and System Safety

journal homepage: www.elsevier.com/locate/ress

On how to define, understand and describe risk

Terje Aven
University of Stavanger, Norway

a r t i c l e in fo abstract

Article history: The prevailing perspectives and definitions of risk, at least in the engineering community, are based on
Received 7 March 2008 probabilities. In this paper we argue that such perspectives and definitions are too narrow. The
Received in revised form probability component of the risk concept should be replaced by uncertainty. By jumping directly into
21 January 2010
probabilities, important uncertainty aspects could easily be overlooked or truncated. In the paper we
Accepted 23 January 2010
Available online 29 January 2010
point at several extended risk definitions, and a formal structure for the various perspectives and
definitions is developed. Fundamental concepts such as second-order probabilities and uncertainties
Keywords: are discussed. Examples are provided showing the importance of the choice of risk perspective in a risk
Risk assessment and decision-making context. The examples cover offshore operations, security and market
Probability
price risks.
Uncertainties
& 2010 Elsevier Ltd. All rights reserved.
Probability of frequency approach
Decision-making

1. Introduction
Risk is defined in many ways. In engineering contexts, risk is
often linked to the expected loss, see e.g. Lirer et al. [26], Mandel
[28], Verma and Verter [39] and Willis [41]. However, such an
understanding of risk means that there is no distinction made
between situations involving potential large consequences and
associated small probabilities, and frequently occurring events
with rather small consequences, as long as the sums of the
products of the possible outcomes and the associated probabil-
ities are equal. For risk management these two types of situations
normally would require different approaches. In general expected
value decision-making is misleading for rare and extreme events
[16]. The expected value does not adequately capture events with
low probabilities and high consequences. Take as examples
nuclear accidents and terrorism risk, where the possible con-
sequences could be extreme and the probabilities are relatively
low. The expected value can be small, say 0.01 fatalities, but
extreme events with millions of fatalities may occur, and this
needs special attention.
We conclude that we need to see beyond expected values
when addressing risk. This is also reflected in the ways risk most
commonly is defined in standards and in the scientific literature.
Some typical definitions are:
(1) Risk is a measure of the probability and severity of adverse
effects [23].
(2) Risk is the combination of probability of an event and its
consequences [19].
E-mail address: terje.aven@uis.no
(3) Risk is equal to the triplet (si, pi, ci), where si is the ith scenario,
pi is the probability of that scenario, and ci is the consequence
of the ith scenario, i=1,2, y, N [20,21,42].
What is common for all these definitions is that the concept of
risk comprises events (initiating events, scenarios), consequences
(outcomes) and probabilities. Uncertainties are expressed through
probabilities. Severity is a way of characterising the consequences
(refer Section 2.3). We formalise this by writing
Risk ¼ ðA; C; PÞ;
where A represents the events (initiating events, scenarios), C the
consequences of A, and P the associated probabilities. Examples of
events A are: gas leakage occurring in a process plant, and the
occurrence of a terrorist attack. Examples of C are the number of
causalities due to leakages, terrorist attacks, etc.
This is the starting point for this paper and our concern. Is
(A,C,P) an adequate description of risk? Are probabilities able to
express the uncertainties, about the events and consequences? A
probability is a way of expressing to what extent an event or
consequence is likely to occur, but what does this mean?
There are basically two ways of interpreting a probability [9,3]:
(a) A probability is interpreted as a relative frequency Pf: the
relative fraction of times the event occur if the situation
analysed were hypothetically ‘‘repeated’’ an infinite number
of times. The underlying probability is unknown, and is
estimated in the risk analysis. We refer to this as the relative
frequency interpretation.
(b) Probability P is a measure of uncertainty about future events
and consequences, seen through the eyes of the assessor and

0951-8320/$ - see front matter & 2010 Elsevier Ltd. All rights reserved.
doi:10.1016/j.ress.2010.01.011
 ARTICLE IN PRESS
624 T. Aven / Reliability Engineering and System Safety 95 (2010) 623–631

based on some background information and knowledge. A quick look at (4–8) may give the impression that they are not
Probability is a subjective measure of uncertainty, conditional that different from (1–3). However, there are important principle
on the background knowledge (the Bayesian perspective). differences, as will be clear from the coming analysis. Probability is
just a tool used to represent or express the uncertainties. The thesis
of all the perspectives and definitions (4–8) is that risk should not
A probability can also be given other interpretations ([36],
be limited to (A,C,P). The uncertainties should be highlighted. But
Section 2.3), but for practical use in a risk context we see no
what does this mean? The purpose of the present paper is to
alternatives to (a) and (b).
discuss this issue and provide a formal structure (framework) for
Following definition (a) we produce estimates of the under-
the perspectives and definitions (1–8). The structure distinguishes
lying ‘‘true’’ risk. This estimate is uncertain, as there could be large
between the risk concepts on the one hand and risk descriptions on
differences between the estimates and the correct risk values. As
the other, and clarifies the meaning of fundamental concepts such
these correct values are unknown it is difficult to know how
as second-order probabilities and uncertainties.
accurate the estimates are.
There are also other types of risk perspectives and definitions.
Kaplan and Garrick [20] (see also Abramson [1] and [2]) meet
We would like to mention two which are often referred to in the
this challenge by introducing subjective probabilities P expressing
economic risk and decision analysis field. The first defines risk by
the analyst’s epistemic uncertainty about the relative frequencies.
the expected disutility, i.e. Eu(C), where C is the outcomes
A relative frequency is the number of times the event of interest
(consequences) and u(C) the utility function [11]. Among classical
occurs per unit of time (or any other reference) when the
decision theorists the expected (dis)utility provides the basis for
‘‘experiment’’ is repeated a large number of times. However,
rational choices. According to this definition, the preferences of
considering a suitable unit of time this means in practice the same
the decision-maker is a part of the risk concept. The result is a
as Pf: Alternatively we may view the frequency as an expected
mixture of scientific assessments of uncertainties about C and the
value—the expected number of occurrences per unit of time,
decision-maker’s preferences and values concerning different
which is interpreted as the average number of occurrences when
values of C and the associated probabilities. In our view, and
the ‘‘experiment’’ is repeated a large number of times. The
this view is shared by many risk experts, the preferences and
approach is referred to as the probability of frequency approach.
values should not be a part of the risk concept and the
The variation in the outcomes of the ‘‘experiment’’ that for
risk assessments [30]. There will be a strong degree of arbitrari-
example generates the true value of Pf, is often referred to as
ness in the choice of the utility function, and some decision-
aleatory (stochastic) uncertainty. This uncertainty is, however, not
makers would also be reluctant to specify the utility function as it
an uncertainty for the analysts, and is better referred to as variation.
reduces their flexibility to weight different concerns in specific
Following the Bayesian approach (b), we assign a probability
cases. Risk should be possible to describe also in case that the
by performing uncertainty assessments, and there is no reference
decision-maker is not able or willing to define his/her utility
to a correct probability. A probability is always conditional on a
function.
background knowledge, and given this background knowledge
In the second definition, risk refers to situations with objective
there is no uncertainties related to the assigned probability, as it
probabilities forthe randomness the decision-maker is faced with
is an expression of uncertainty.
[14]. In economic applications a distinction has traditionally been
Note that the definitions (1–3) above can be applied for both
made between risk and uncertainty: Under risk the probability
interpretations of a probability.
distribution of the performance measures can be assigned
Probabilities are used as a tool to express uncertainties, but
objectively, whereas under uncertainty these probabilities must
how good is this tool? Consider the probability P(attack), where
be assigned or estimated on a subjective basis. This perspective
the event ‘‘attack’’ is related to a specific period of time and
goes back to Knight [22]. The risk concept then expresses
location. Say that the assigned probability equals 0.01. Does this
variation in populations and is referred to as aleatory uncertainty
number provide an informative description of the uncertainties
[30]. Although this definition is often referred to, it is not so often
related to the event ‘‘attack’’? No, would be the clear answer from
used in practice. The problem is of course that we seldom have
many risk researchers and analysts. Uncertainties beyond the
known, objective distributions, and then we cannot refer to the
probabilities should be taken into account. Several definitions of
risk concept. The Knightian definition violates the intuitive
risk have been suggested in line with this thinking, including
interpretation of risk [38,18], which is related to situations of
uncertainty and lack of predictability, and is in general incon-
(4) Risk refers to uncertainty of outcome, of actions and events sistent with all the definitions (1–8). We will not look closer at
[12]. these two definitions in this paper.
(5) Risk is a situation or event where something of human value The paper is organised as follows. We first, in Section 2,
(including humans themselves) is at stake and where the present the announced risk perspective structure. Then we look at
outcome is uncertain [32,33]. some examples, the aim being to illustrate the definitions and
(6) Risk is an uncertain consequence of an event or an activity analysis of Section 2, as well as showing the importance of the
with respect to something that humans value [31]. choice of risk perspective in a risk assessment and decision-
(7) Risk is equal to the two-dimensional combination of events/ making context. Section 4 discusses the structure and examples.
consequences and associated uncertainties [4,6]. The final Section 5 provides some conclusions and final remarks.
(8) Risk is uncertainty about and severity of the consequences (or
outcomes) of an activity with respect to something that
humans value [7]. 2. Risk definitions and descriptions

These definitions can be divided into subgroups, see discussion
in Section 2.3. Kaplan and Garrick [20] define risk by (3) but early
in their paper they state that risk has two basic dimensions:
Uncertainties and C (they use the term damage). So Kaplan and
Garrick [20] were certainly aware of the need for seeing
uncertainties as a part of risk.
We consider an activity and make the following definitions of
risk associated with this activity:
(i) Risk= (A,C,Pf), where Pf is a relative frequency-interpreted
probability (or a related parameter such as the expected
number of occurrences of the event A per unit of time, where
 ARTICLE IN PRESS
T. Aven / Reliability Engineering and System Safety 95 (2010) 623–631
the expectation is with respect to a relative frequency-
interpreted probability).
(ii) Risk= (A,C,U), where U is the uncertainty about A and C (will A
occur and what will the consequences C be?), including
uncertainty about underlying factors influencing A and C.
We refer to (i) as the frequency-based perspectives or
approaches, and (ii) as the alternative perspectives or approaches.
Hence risk in case (i) exists ‘‘objectively’’. As an example
consider the operation of a plant and the risk associated with
accidents that could lead to fatalities. Then we can define events
(such as gas leakages), associated consequences (losses), and
frequentist probabilities expressing for example the probability Pf
of at least 10 fatalities next year. The Pf is interpreted as a
property of the plant, or more precisely, of the infinitely large
population of similar plants that this particular plant belongs to.
The probability Pf equals the fraction of plants in this population
where an event occurs resulting in at least 10 fatalities. As Pf is
unknown it has to be estimated. The estimation is of course in
general analyst dependent.
In case (ii), risk exists ‘‘objectively’’ provided that the
uncertainty U just refers to the fact that A and C are unknown
and consequently uncertain. However, the degree of uncertainty
is dependent on the assessor’s knowledge and is hence in general
subjective.
This means that the risk description does not exist ‘‘objectively’’;
it is either built on a knowledge-based risk estimate (case (i)) or a
knowledge-based assessment of the uncertainties (case (ii)).
In the following we will look closer into the risk descriptions
associated with the definitions (i) and (ii). We will also compare
the definitions (4–8) and (ii). The definitions (1–3) are covered by
the perspective (i) if the probabilities are relative frequency
interpreted. If the probabilities are subjective, the definitions
(1–3) can be considered modified versions of (ii) with U replaced
by a subjective probability P.
2.1. Risk description for the relative frequency case (i)
In case (i), the risk is unknown as Pf is unknown. Risk
assessment is introduced to describe the risk. The description
covers an estimate Pf* of Pf, as well as assessments of uncertainties
about Pf* and Pf. Thus if the relative frequency perspective to risk
is the starting point, we are led to a risk description:
ðiÞ Risk description in the relative frequency case ¼ ðA; C; Pf ; UðPf Þ; KÞ;
where U(Pf*) refers to an uncertainty description of Pf* relative to
the true value Pf, K is the background knowledge that the estimate
and uncertainty description is based on. We refer to U(Pf*) as a
second-order uncertainty description. If we use subjective
probabilities P to express our uncertainties about Pf, in line with
the probability of frequency approach, the risk description takes
the form:
ðiÞ Risk description according to the probability of frequency

approach ¼ ðA; C; Pf ; PðPf Þ; KÞ;
where K now is the background knowledge that the estimate Pf*
and the probability distribution P is based on. Kaplan and Garrick
[20] refer to this description as the second level definition of
risk—it is combined with the first level (A,C,P) definition (3) (see
Section 1).
The probability P is a second-order probability. Möller et al.
[29] claim that the attitude of philosophers and statisticians
towards second-order probabilities has been mostly negative, due
to fears of an infinite regress of higher and higher orders of
probability. This is hard to understand, as noted also by Sahlin
625
[34]. It has no meaning talking about uncertainties of a subjective
probability. A subjective probability is a measure of uncertainty
seen through the eyes of the assessor. If he/she assigns a
probability equal to 1%, it is compared to a drawing of a particular
ball out of an urn consisting of 100 balls [24,25]. Alternatively a
subjective probability may be defined by reference to betting. In
this case the probability of the event B is the price you would pay
in return for a unit of payment to you if the event B actually
occurs [36]. We prefer the former definition of a subjective
probability as we dislike risk being associated with our attitude to
wining or loosing money in gambling situations [3].
This issue has been strongly debated in the literature, see e.g.
Gärdenfors and Sahlin [15] and Sahlin [34]. According to Sahlin
[34] no one would seriously dispute that we have beliefs about
our beliefs. We question this assertion. As a professional risk
assessor, one is trained in the process of transforming uncertainty
into probabilities. If the assessor assigns a probability of an event
B equal to 0.3 based on a specific background knowledge, there is
no reason why he/she should dispute his own assignment as it
expresses his/her uncertainties (degree of belief). He/she may
experience a precision problem, in particular when assessing
events on the lower part of the probability scale. It could for
example be difficult to distinguish between numbers such as 10  5
and 10  6. However, the second-order probability issue is in our
view not about having beliefs about beliefs, but the limitations of
the probabilities in capturing the relevant uncertainty aspects.
The second-order probabilities, i.e. the subjective probabilities,
are based on a background knowledge and this knowledge could
be wrong or poor in many respects. How should we reflect this in
our risk description? Should we add an uncertainty component U
in the risk description (A,C,Pf*,P(Pf),K), so that it becomes
(A,C,Pf*,P(Pf),U,K)? Yes, this is our recommendation. We need to
see beyond the subjective probabilities P. What this U dimension
would capture will be discussed in more detail in Section 2.2 and
in Sections 3 and 4.
Although not mentioned so far, sensitivities constitute an
integral part of the risk description. The sensitivities show how
the output risk indices, for example Pf* and P(Pf), are influenced by
changes in the background knowledge, in particular assumptions
and suppositions.
The starting point for this analysis of the second-order
probabilities was the risk concept (A,C,Pf) and following the
probability of frequency approach we are led to the Bayesian set-
up. In cases of observations X, Bayesian updating of the subjective
probabilities P are carried out using the standard Bayesian
machinery going from a prior distribution to the posterior
distribution. Bayesian theorists would not, however, refer to
the Pf values as probabilities, but chances or propensities. A
pure traditional statistical approach would not allow for sub-
jective probabilities P. The uncertainty U(Pf*) in (i) would only
reflect statistical variation, and could be expressed using a
confidence interval. The degree of relevancy of the data would
then not be taken into account. For this approach we obtain a risk
description
ðiiÞ0 Risk description according to the pure traditional statistical
approach ¼ ðA; C; Pf ; CðPf Þ; KÞ; where C is a traditional
confidence interval for Pf :
2.2. Risk description for the alternative approach (ii)
Next we look closer at the alternative definition (ii) where risk
equals (A,C,U). A risk description based on this definition would
 ARTICLE IN PRESS
626 T. Aven / Reliability Engineering and System Safety 95 (2010) 623–631
cover the following components:
ðiiÞ Risk description ¼ ðA; C; U; P; KÞ;
where P is a subjective probability expressing U based on the
background knowledge K. This description covers probability
distributions of A and C, as well as predictions of A and C, for
example a predictor C* given by the expected value of C,
unconditionally or conditional on the occurrence of A, i.e. C* = EC
or C* =E[CjA]. As for case (i) sensitivity analysis constitutes an
integral part of the risk description.
Also in this perspective we may introduce stochastic models
(with parameters) expressing aleatory uncertainties, i.e. variation
in populations of similar units. However, such models need to be
justified, and if introduced they are to be considered as tools for
assessing the uncertainties about A and C. The estimation of the
parameters of the models is not the end product of the analysis as
in the case (i).
Using the description (ii)’ there are no second-order probabil-
ities, as it has no meaning talking about uncertainties of a
subjective probability, as discussed above. As subjective prob-
abilities are used, this perspective is also Bayesian, although it has
a different focus and is based on other building blocks than the
probability of frequency approach.
2.3. Comparison of the definitions (4–8) and the alternative
approach (ii)
Now let us examine how the definitions (4–8) relate to the risk
definition (A,C,U) and description (ii)0 .
According to (4) risk refers to uncertainty of outcome, of
actions and events [12]. Hence strictly speaking risk is not (A,C,U)
but only U. As an example, consider the number of fatalities in
traffic next year in a specific country. Then the uncertainty is
rather small, as the number of fatalities shows rather small
variations from year to year. Hence according to this definition of
risk, we must conclude that the risk is small, even though the
number of fatalities is many thousands each year. Clearly, this
definition of risk fails to capture an essential aspect, the
consequence dimension. Uncertainty cannot be isolated from
the intensity, size, extension, etc. of the consequences. Take an
extreme case where only two outcomes are possible, 0 and 1,
corresponding to 0 and 1 fatalities, and the decision alternatives
are r and s, having uncertainty (probability) distributions (0.5,
0.5), and (0.0001, 0.9999), respectively. Hence for alternative r
there is a higher degree of uncertainty than for alternative s,
meaning that risk according to this definition is higher for
alternative r than for s. However, considering both dimensions,
both uncertainty and the consequences, we would of course judge
alternative s to have the highest risk as the negative outcome 1 is
nearly certain to occur.
According to the definition (5), risk is a situation or event
where something of human value (including humans themselves)
is at stake and where the outcome is uncertain [32,33]. Hence
strictly speaking risk is A, and not as in our definition (A,C,U).
However, Rosa expresses risk using the description (A,C,U), and
refers to probability as a tool to describe the uncertainties. The
Rosa [32,33] definition is thoroughly discussed by Aven and Renn
[7]. The conclusion is that compared to common terminology, the
Rosa definition leads to conceptual difficulties that are incompa-
tible with the everyday use of risk in most applications. By
considering risk as an event (A), we cannot conclude, for example,
about the risk being high or low, or compare different options
with respect to risk. The same conclusion is made for the
definition (6), which says that risk is an uncertain consequence
of an event or an activity with respect to something that human
value [31]. This definition is similar to Rosa [32,33]’s definition
but the event A is replaced by the consequence C.
The definitions (7) and (8) are consistent with the (A,C,U)
definition, although (8) introduces the term severity which refers
to intensity, size, extension, scope and other potential measures of
magnitude, and affects something that humans value (lives, the
environment, money, etc). Losses and gains, for example ex-
pressed by money or the number of fatalities, are ways of defining
the severity of the consequences. It is important to note that the
uncertainties relate to the events and consequences—the severity
is just a way of characterising the consequences.
Based on the perspectives and definitions (4–8), various types
of risk descriptions can be specified, for example the description
(ii)’ given by (A,C,U,P,K). For all these addressing uncertainties
instead of probabilities is an important feature. The probability
assignments are conditioned on a number of assumptions and
suppositions. The assignments are not expressing objective
results. Uncertainties are often hidden in the probabilities, and
restricting attention to these quantities could camouflage factors
that could produce surprising outcomes. The examples in the
coming section will make this clear.
3. Examples
In this section we present three cases where we show the
importance of considering uncertainties beyond probabilities. All
numbers presented are fictitious. The two first examples are
based on real problems.
3.1. Offshore diving activities
Let us go back to the 1970s and consider the risk related to
future health problems for divers working on offshore petroleum
projects in this period of time. We distinguish between the two
risk definitions and descriptions (i) and (ii) introduced in Section 2.
Let us first look at the probability of frequency approach. A relative
frequency-interpreted probability Pf is defined expressing the
probability that a random chosen diver would experience health
problems (properly defined) during the coming 30 years due to the
diving activities. The probability Pf is unknown and needs to be
estimated. Based on the available knowledge at that time an
estimate Pf*=0.01 of Pf is established. Uncertainties are expressed
using subjective probabilities according to the probability of
frequency approach. A 90% credibility interval [0.001, 0.1] is
computed, expressing that the posterior probability that Pf lies in
this interval is 90% given the available data and knowledge about
the phenomena in general. There are not strong indications that
the divers will experience health problems. This would be a risk
description (A,C,Pf*,P(Pf),K) according to (i)’. It is standard risk
assessment description which includes second-order probabilities.
These probabilities indicate that one would not expect severe
health problems for the divers in the future. However, we know
today that these probabilities led to poor predictions. A large
number of the divers have experienced severe health problems
([8]: 7). Also at the time of the assessment there were
uncertainties about the future health conditions, but the un-
certainties were not revealed by the probabilistic analysis.
To improve the assessment, a change of the main risk index is
suggested: instead of Pf, focus is on the probability distribution Ff
of the proportion D of divers that will experience health problems.
Note that Pf equals the expected value of D. To see let n be the
number of divers in the population, and let I(B) denote this
indicator function for the event B, which is equal to 1 if B occurs
 ARTICLE IN PRESS
T. Aven / Reliability Engineering and System Safety 95 (2010) 623–631
and 0 otherwise. Then we see that
P However, all industries would introduce some minimum require-
Pf ¼ j Pðperson j experiences health problemsÞ=n
X
¼E Iðperson j experiences health problemsÞ=n ¼ ED;
j
which proves the assertion.
The assessment produces for example an estimate p*(0.1) of
the probability p(0.1) that more than 10% of the divers would get
health problems. We may also express second-order probabilities
for example using credibility intervals as shown above for Pf.
Suppose that p*(0.1) = 0.05 and a 90% credibility interval equals
[0.001, 0.20].
Certainly, this change of risk parameter, seeing beyond the
expected value based parameter Pf, has given a more informative
risk description, but still the conclusion would be that we do not
expect severe health problems for the divers in the future; the
probabilities are low.
Next we consider the problem following the risk perspective
(ii). Relative frequency-interpreted probabilities are not intro-
duced. The risk description covers (A,C,U,P,K) using the notation of
Section 2. The assessment covers a probabilistic analysis produ-
cing for example an assigned probability distribution of D, a 90%
prediction interval [a, b] of D (such that P(a rDrb)= 0.90), as well
as an assignment of the probability that a random chosen diver
would experience health problems. In addition assessment of
uncertainties beyond probabilities is required.
This uncertainty assessment could for example take the
following form. First a set of uncertainty factors are identified.
These factors relate to the underlying understanding of relevant
physiological and psychological phenomena, as well as assump-
tions and suppositions made in the probabilistic analysis. An
example of such a factor is the diving operations’ effect on the
brain, in particular related to long term effects on forgetfulness. The
data used as a basis for the analysis do not show a significant
difference between divers and non-divers. However, the data
material is not extensive and is limited to a rather short time
interval compared to the 30 years addressed in the risk assessment.
Each factor’s importance is measured using a sensitivity analysis.
Is changing the factor important for the risk indices considered, for
example the distribution of D. If this is the case, we next address the
uncertainty of this factor. Are there large uncertainties about this
factor? If the uncertainties are assessed as high, the factor is given a
high risk score. Hence to obtain a high score in this system, the
factor must be judged as important for the risk indices considered
and the factor must be subject to large uncertainties.
One may question whether it is not possible to include the
uncertainty factor explicitly in the probabilistic calculations. To
this is to say that for some factors that could be possible, in some
cases. Consider for example the above factor related to long term
effects on forgetfulness. Suppose the probabilistic assessment was
first based on the assumption that the diving had no effect on the
forgetfulness. Then we can perform a reassessment where this
assumption is left out. The result would be small changes in the
probabilities, as the assessment would be dominated by the view
that there is no information supporting the rejection of the
assumption. The importance of the uncertainty is marginal
measured by the probabilities.
By addressing the issue as an uncertainty factor its importance
is increased. For the decision-makers who need to balance
different concerns and determine to what extent principles of
caution and precaution should be applied, such information is
required. The cautionary principle is a basic principle in risk and
safety management, expressing that in the face of uncertainty,
caution should be a ruling principle, for example by not starting an
activity, or by implementing measures to reduce risks and
uncertainties [8,43]. The level of caution adopted will of course
627
have to be balanced against other concerns such as costs.
ments to protect people and the environment, and these
requirements can be considered justified by the reference to the
cautionary principle. The precautionary principle may be con-
sidered a special case of the cautionary principle, as it is
applicable in cases of scientific uncertainties about the possible
consequences of the activity being considered [27,35,44].
In this particular case, it is obvious that weight given to the
cautionary and precautionary principles would had significantly
reduced or even ended the diving operations at that time.
However, the task of balancing different concerns and give weight
to the uncertainties is a management (here political) responsi-
bility, and the decision made was to perform such diving
operations. We may just speculate whether a risk perspective
highlighting the uncertainties would have changed the decision. It
could have, but probably not as the economic incentives for
performing the activities were so strong.
3.2. Security example
In May 2005 the NOKAS Cash depot moved into its new
premises at Gausel in Stavanger, Norway. The area in which the
building is located is called Frøystad and is zoned for industry. The
closest neighbour, however, is a cooperative kindergarten, and the
NOKAS facility is located not far from a residential area. In light of
the risk exposure to the children in the kindergarten and other
neighbours—caused by possible robberies—the residents feel that
the NOKAS facility must be moved, as the risk is unacceptable. The
municipality of Stavanger carried out a process to help them take
a position to this question, and hired consultants to describe and
assess the risk. There was a significant amount of discussion on
how the risk management process should be carried out. Here, we
deal especially with the understanding of risk and the risk
assessment.
On the average, there have been 6 robberies or attempted
robberies per year of money conveyances in Norway in the past 5
years [37]. The number of ‘‘destinations’’ (NOKAS facilities) is
calculated to be 20. A historically based probability that an attempt
will be made to rob a money conveyance on its way to/from the
NOKAS facility at Frøystad is then 6/20=0.30, i.e. 30% per year.
Following the traditional risk approach (i) we interpret 0.30 as
an estimate of the true underlying probability Pf that a money
conveyance will be robbed. Then we should specify second-order
probabilities P, and one option is to use the data at hand to produce
a traditional confidence interval, for example a 90% confidence
interval [0.1, 0.5] (say). However, this interval only reflects the
statistical variation, not the relevancy of the data. Using subjective
probabilities to express the uncertainties about Pf, in line with the
probability of frequency approach, we derive at a 90% credibility
interval [0.05, 0.6], say. The analysis group is 90% confident that the
true underlying probability Pf lies in this interval.
This assessment is strongly dependent on the assumptions
made. Which year should be used as the starting point for the data
used? Why the past five years? Why not the past 10 years or the
past three years? Some would argue that the future will bring
more robberies where force is used. The arguments are:
 Organised crime is a problem that is on the increase both in
Norway and elsewhere in Europe.
 Norway is experiencing that certain criminal groups, from
certain countries, are establishing themselves in the country.
 The extension of the EU to the east, and the opening up of
borders in the Schengen agreement, promises a ‘‘free move-
ment of crime’’.
 ARTICLE IN PRESS
628 T. Aven / Reliability Engineering and System Safety 95 (2010) 623–631

 Recent events have indicated an increase in the use of force in Table 1

robberies and attempted robberies. Prices for two products the last 12 months.
There are however, many arguments supporting that the
Month Product 1 2 3 4 5 6 7 8 9 10 11 12
number of robberies will decrease:
1 10 11 13 12 13 12 14 13 14 15 17 17
 Systematic safety and security work is being undertaken by 2 12 11 12 14 14 14 16 15 16 13 12 13
the industry to counteract the conditions noted above.
 In particular, the facility at Gausel is characterized by an
entirely different standard of safety/security than those 18
facilities that have been robbed in recent years.
 It is Norwegian currency that is exposed here, and this 16
currency is more difficult to dispose of than, for example,
euros. 14
 From the available statistics, we do not see any negative
developments; rather we see a slight trend for the better. 12

10

Price
The uncertainties are large, in particular related to the manner
in which a possible attack will take place. A possible scenario is
8
that an attack will occur in an innovative, surprising and brutal
way. The use of hostages is a clear possibility during such an
6
attack, and the result could easily be injuries and fatalities.
The analysts may assess the likelihood related to these factors, 4
but as the uncertainties are so large, the decision-makers would
probably prefer to have the magnitudes and the sources of 2
uncertainties displayed before making an informed judgment.
Adopting the alternative approach (ii), these uncertainties 0
constitute a part of risk description. It is acknowledged that the 0 5 10 15
probabilistic analysis is not able to capture all the relevant risk
Month
features. Subjective probabilities may be assigned, and their
dependencies on key assumptions shown. Yet the probabilistic Fig. 1. Prices as a function of time for two products, based on data of Table 1.
analysis would be too narrow, in the sense that it would not be
able to capture the importance of the uncertainties. Surprises may
Table 2
occur. Depending on the assumptions made a probability assign-
Computed means and empirical standard deviations for the two products 1 and 2.
ment (for a period of one year) of 0.01–0.1% that a third person
will be seriously injured or killed as a result of a NOKAS-related Product Mean (M) Empirical standard
attack is reported. In addition assessments are performed for deviation (S)
some key uncertainty factors as described in Section 3.1.
1 13.42 2.06
Examples of such factors are:
2 13.50 1.56

 Possible trends within the robbery environment.

 The scenario development in the case of an attack.
A particularly important point is the manner in which a possible
attack will take place as discussed above. If one assumes a strong
increase in the aggravated robbery environment, we arrive at a
probability of 0.1% for a third party being seriously injured or
killed as a result of a NOKAS-related attack. The risk picture thus
covers probabilities but also qualitative assessments of key
uncertainty factors.
In this case the experts produced a risk picture based on the
approach (A,C,P,K), i.e. the approach (ii) but without addressing
uncertainties beyond the probabilities [37,6]. The produced
results were interpreted by the bureaucrats of the municipality
as saying that the risk was low and acceptable, as the assigned
probability numbers were below some typical reference levels.
The conclusion could have been the same with the uncertainties
highlighted; however, such an extended risk description would
have given a more informative decision basis and led to a stronger
involvement of the politicians as the bureaucrats would not have
been able to conclude.
3.3. Market price risk
Consider a company producing two types of products. Table 1
and Fig. 1 show the price for the two products the last 12 months.
We may alternatively interpret the data as accident data, for
example representing the number of injuries observed for two
production units as a function of month.
Based on these data, we calculate the mean prices and
empirical standard deviations as shown in Table 2:
We see that the mean prices for the two products are about the
same, but the standard deviation is much larger for product 1. It
seems that the price for product 1 has an increasing trend.
What about risks? What is the price risk? The above numbers
do not show the risks, just the historical prices. The data may be
used to say something about the future and the risks.
The way this is done depend on the risk perspective. In the
traditional statistical case we may be concerned about the
expected price the next month, or the probability that the price
next month is below or above a certain number. This expected
value and these probabilities (referred to as the parameters) are
given a relative frequency interpretation. Based on the observed
data, we estimate the parameters, and uncertainties are expressed
for example using confidence intervals. Regression analysis could
be used to estimate possible trends. We omit the details, as this
would be a standard statistical analysis as found in most text-
books in statistics.
The probability of frequency approach would lead to second-
order probabilities P expressing the analysts’ uncertainty about
the true value of these parameters. This analysis may for example
 ARTICLE IN PRESS
T. Aven / Reliability Engineering and System Safety 95 (2010) 623–631
result in a 90% credibility interval [10, 17] for the expected price
next year.
If we adopt the alternative perspective, we would produce
predictions of the prices, for example a 90% prediction interval
[11, 17] (say). In addition uncertainties beyond the probabilistic
analysis will be highlighted. A number of uncertainty factors are
identified. Examples include the competitive conditions, econom-
ic trends, and political events.
The probabilistic analysis need to be based on a set of
assumptions. But they could be wrong. If there is a trend in price
levels for product 1, it would be more reasonable to predict a price
level of about 18 (next month) and not 13.4. If we use the same
spread as above, we arrive at a prediction interval of [14, 22]. Only
hindsight can show which one is the best prediction, but the
analysis makes it clear that a simple transformation of the
historical figures can lead to very poor predictions.
By attempting to understand the data, by assuming a trend and
carrying out a regression analysis, we may be able to improve the
predictions. But we may also end up ‘‘over-interpreting’’ the data
in the sense that we look for all sorts of explanations for why the
historical figures are as they are. Perhaps prices are rising;
perhaps the trend arrow will be reversed next month. We can
analyse possible underlying conditions that can affect prices, but
it is not easy to reflect what the important factors are, and what is
‘‘noise’’ or arbitrariness.
An analysis based on the historical numbers could easily
become too narrow and imply that extreme outcomes are
ignored. Surprises occur from time to time, and suddenly an
event could occur that dramatically changes the development,
with the consequence that the prices jump up or down. In a risk
analysis such events should ideally be identified. However, the
problem is that we do not always have the knowledge and
insights to be able to identify such events, because they are
extremely unexpected. By assessing uncertainties beyond the
probabilistic analysis, we are able to give the decision-makers a
more informative risk description; that is the best we can do.
4. Discussion
What a relative frequency-interpreted probability means, is
obvious when performing controlled experiments. However, for
more complex situations such an interpretation of probability is
not obvious. The issue has been discussed thoroughly in the
literature (e.g. [9,3]). For the three examples above, how should
we understand:
 the probability that a random chosen diver would experience
health problems (properly defined) during the coming 30 years
due to the diving activities;
 the probability that a money conveyance will be robbed the
coming year;
 the probability that the price next month will be below a
threshold z?
To understand what these probabilities mean, we need to
construct an infinite large population of thought-constructed
repeated experiments, similar to the one studied. This is difficult
to do in all these examples. For instance, what is the meaning of a
large set of ‘‘identical’’, independent robbery situations, where
some aspects (for example related to the potential attackers and
the political context) are fixed and others (for example the
attackers motivation) are subject to variation. Say that the specific
probability is 10%. Then in 1000 situations, with the attackers and
the political context specified, the attackers will attack in about
100 cases. In these situations the attackers are motivated, but not
629
in the remaining ones. Motivation for an attack in one situation
does not affect the motivation in another. For independent
random situations such ‘‘experiments’’ are meaningful, but not
for unique situations like this.
‘‘Anti-frequentists’’ would conclude that the relative fre-
quency-interpreted probability does not exist and in a way
constructs uncertainties: first we define a theoretical quantity
that does not exist in the real world, and then we become
uncertain what its correct value is. As the three examples above
show, the interpretation of such probabilities is not clear. How
can we then estimate and assess uncertainties in a meaningful
way?
If the relative frequency approach is used, it is not sufficient to
estimate the frequencies Pf. Uncertainties need to be addressed to
perform a complete analysis. However, this is not straightforward
as is demonstrated by attempting to apply the probability of
frequency approach. The ambition of this approach is to express
the epistemic uncertainties of the relative frequencies, and take
into account all relevant factors causing uncertainties. The
analysis may produce a 90% credibility interval [a, b] for Pf,
saying that the analyst is 90% confident that Pf lies in the interval
[a, b]. In practice it is difficult to perform a complete uncertainty
analysis following this approach. In theory an uncertainty
distribution on the total model and parameter space should be
established, which is impossible to do. So in applications only a
few marginal distributions on some selected parameters are
normally specified, and therefore the resulting uncertainty
distributions are just reflecting some aspects of the uncertainty.
This makes it difficult to interpret the produced uncertainties.
Quantifying risk using probabilities gives an impression that
risk can be expressed in a very precise way. However, in most
cases, the arbitrariness is large, and the (A,C,U) approach
acknowledges this by providing a more nuanced risk picture,
which includes factors that can cause ‘‘surprises’’ relative to the
probabilities. Probabilistic analysis requires strong simplifications
and assumptions and, as a result, important factors could be
ignored or hidden in the background knowledge. In a broader
uncertainty analysis a more comprehensive risk picture can be
established, taking into account these factors.
The frequentists and the Bayesian schools of thought have
collided for many years over the definition of probability, sowing
considerable confusion over the definition of risk and the limits of
probabilistic risk analysis [30]. Attempts at reconciliation of these
two perspectives have led to the probability of frequency
approach, as described and discussed in previous sections.
However, on both sides of this approach we have other
approaches, the pure traditional statistical approach and the
alternative Bayesian approach (ii). To see the similarities and
differences between all these approaches, we need an adequate
structure, and the aim of the framework presented in Section 2
has been to establish such a structure. A key idea of this structure
is the distinction between the approaches (i) and (ii), which we
consider essential for obtaining a logical and consistent frame-
work.
Classical decision theorists have often taken the stand that the
distinction between aleatory and epistemic uncertainties as in the
probability of frequency approach is unnecessary because,
according to the axioms of expected-utility decision analysis, it
is irrelevant in rational choices [30]. All one needs is their
common measure, the Bayesian (subjective) probability, that can
characterize both. The different probabilities can then be
combined for decision-making purposes as if all uncertainties
were of the same nature. Such a view is, however, disputed by
many researchers and analysts. As argued by Paté-Cornell [30],
rationality can be viewed as more complex than the simple
maximization of expected utility. Decision-makers may need
 ARTICLE IN PRESS
630 T. Aven / Reliability Engineering and System Safety 95 (2010) 623–631
and/or ask for a full display of the magnitudes and the sources of
uncertainties before making an informed judgement.
Such a perspective provides the basis for the risk definitions
(4–8) introduced in Section 2. They all consider uncertainty as a
main component of a risk description—probability is a just a tool
used to express the uncertainties. Various attempts have been
made to describe the uncertainties, but one should acknowledge
that the full scope of these uncertainties cannot be transformed to
a mathematical formula, using probabilities or other measures of
uncertainty. Numbers can be generated but would not alone serve
the purpose of the risk assessment, to reveal and describe the
risks and uncertainties. Trying to be precise and accurately
expressing what is extremely uncertain does not make sense.
We believe a more open qualitative approach for revealing such
uncertainties, as indicated in the previous sections, is better. Some
would feel this as less attractive from a methodological and
scientific point of view—perhaps it is, but it would be more suited
for solving the problem at hand, which is about analysis and
management of risk and uncertainties.
5. Conclusions and final remarks
It is common to define and describe risk using probabilities
(combined with events and consequences). In this paper it is
argued that these perspectives and definitions are too narrow.
They do not reflect that probabilities are imperfect tools for
expressing uncertainties. The assigned probabilities are condi-
tioned on a number of assumptions and suppositions. They
depend on the background knowledge. Uncertainties are often
hidden in the background knowledge, and restricting attention to
the assigned probabilities could camouflage factors that could
produce surprising outcomes. By jumping directly into probabil-
ities, important uncertainty aspects are easily truncated, meaning
that potential surprises could be left unconsidered.
Several risk perspectives and definitions exist in line with
these acknowledgments. In the paper they are referred to as the
(A,C,U) perspectives. Some of these risk perspectives are not
including all the components of (A,C,U) in their definitions, but
the corresponding risk descriptions are consistent with this
thinking, that risk should be described by (A,C,U) and using an
adequate measure of uncertainty. In the paper we have
established a structure (framework) for the various perspectives
which clarifies the differences between and the similarities of
these perspectives.
For problems with large uncertainties, risk assessments could
support decision-making, but other principles, measures and
instruments are also required, such as the cautionary/precau-
tionary principles. We need to provide informative decision
support, but the information basis should be more nuanced than
can be obtained by probabilistic analysis alone.
This rather negative view concerning the number-crunching
exercises in risk assessment, would also apply to other ways of
expressing uncertainties, including intervals of probability [13].
However, the uncertainty issue in risk assessments is challenging
and the research in this field will obviously benefit from a set of
different research perspectives. Our work must be viewed as one
out of several possible research directions. It is based on
probability and probability calculus, but is open for extensions
that are required to adequately describe and handle risk.
Bayesian updating plays an important role in the risk analyses
by allowing for systematic integration of prior knowledge and
observations. However, its use assumes some sort of model
stability as pointed out in previous sections: populations of similar
units need to be constructed (formally an infinite set of exchange-
able random variables). But such a stability is often not fulfilled.
Bergman [10] addresses this issue in a recent paper. He argues for
an extended subjectivist approach, a conceptualistic pragmatism,
which links the subjectivist approach with the quality movement
with its focus on continuous improvement. An interesting future
research challenge is the link between this conceptualistic
pragmatism and the (A,C,U) type of risk perspectives.
The emphasis on uncertainties instead of static probabilities
may be considered in line with important safety research
directions, such as Resilience Engineering (e.g. [17]) and High
Reliability Organisations (HRO) (e.g. [40]). Analysing systemic
accidents and managing the unexpected, there is a need for
concepts and tools that can see beyond the probabilistic world. In
future research we will study this in more detail and in particular
how risk assessments founded on (A,C,U) type of perspectives can
be integrated with Resilience Engineering and HRO.
Acknowledgements
The author is grateful to several anonymous reviewers for
valuable comments and suggestions to earlier versions of this
paper.
References
[1] Abramson LR. Some misconceptions about the foundations of risk analysis.
Risk Analysis 1981;1:229–30.
[2] Apostolakis G. The concept of probability in safety assessments of
technological systems. Science 1990;250:1359–64.
[3] Aven T. Foundations of risk analysis. Chichester: Wiley; 2003.
[4] Aven T. A unified framework for risk and vulnerability analysis and
management covering both safety and security. Reliability Engineering and
System Safety 2007;92:745–54.
[6] Aven T. Risk analysis. Chichester: Wiley; 2008.
[7] Aven T, Renn O. On risk defined as an event where the outcome is uncertain.
Journal of Risk Research 2009;12:1–11.
[8] Aven T, Vinnem JE. Risk Management, with applications from the offshore oil
and gas industry. Springer Verlag; 2007.
[9] Bedford T, Cooke R. Probabilistic risk analysis. Cambridge: Cambridge U.
Press; 2001.
[10] Bergman B. Conceptualistic pragmatism: a framework for Bayesian analysis?
IIE Transactions 2009;41:86–93.
[11] Campbell S. Determining overall risk. Journal of Risk Research 2005;8:
569–81.
[12] Cabinet Office 2002. Risk: improving government’s capability to handle risk
and uncertainty. Strategy unit report. UK.
[13] Coolen FPA, Utkin LV. Imprecise reliability: a concise overview. In: Aven T,
Vinnem JE, editors. Risk, reliability and societal safety, vol. 2. London: Taylor
& Francis Group; 2007. p. 1959–66.
[14] Douglas EJ. Managerial economics: theory, practice and problems, 2nd ed.
New Jersey: Prentice Hall; 1983.
[15] Gärdenfors P, Sahlin N-E. Unreliable probabilities, risk taking, and decision
making. In: Gärdenfors P, Sahlin N-E, editors. Decision, probability, and
utility. Cambridge: Cambridge University Press; 1988. p. 313–34.
[16] Haimes YY. Risk modelling, assessment, and management, 2nd ed. New York:
Wiley; 2004.
[17] Hollnagel E, Woods DD, Leveson N, editors. Resilience engineering, concepts
and precepts. Burlington: Ashgate; 2006.
[18] Holton GA. Defining risk. Financial Analysis Journal 2004;60:19–25.
[19] ISO, 2002. Risk management vocabulary. ISO/IEC Guide 73.
[20] Kaplan S, Garrick BJ. On the quantitative definition of risk. Risk Analysis
1981;1:11–27.
[21] Kaplan S. Risk assessment and risk management—basic concepts and
terminology. In risk management: expanding horizons in nuclear power
and other industries. Boston, MA: Hemisphere Publ. Corp.; 1991. 11-28.
[22] Knight FH. Risk, uncertainty and profit. Washington DC: BeardBooks; 1921.
Reprinted 2002.
[23] Lowrance W. Of acceptable risk—science and the determination of safety.
Los Altos, CA: William Kaufmann Inc.; 1976.
[24] Lindley D. Making decisions. New York: Wiley; 1985.
[25] Lindley D. Understanding uncertainty. New Jersy: Wiley; 2006.
[26] Lirer L, Petrosino P, Alberico I. Hazard assessment at volcanic fields: the
Campi Flegrei case history. Journal of Volcanology and Geothermal Research
2001;112:53–73.
[27] Löfstedt RE. The Precautionary Principle: Risk, Regulation and Politics.
Transactions of IchemE 2003;81:36–43.
 ARTICLE IN PRESS
T. Aven / Reliability Engineering and System Safety 95 (2010) 623–631
[28] Mandel, D., 2007. Toward a concept of risk for effective military decision
making. Defence R&D Canada—Toronto. Technical Report. DRDC Toronto TR
2007-124.
[29] Möller N, Hansson SO, Person M. Safety is more than the antonym of risk.
Journal of Applied Philosophy 2006;23:419–32.
[30] Paté-Cornell ME. Uncertainties in risk analysis: Six levels of treatment.
Reliability Engineering and System Safety 1996;54(2-3):95–111.
[31] Renn O. Risk governance. White paper no. 1. Geneva: International Risk
Governance Council; 2005.
[32] Rosa EA. Metatheoretical Foundations for Post-Normal Risk. Journal of Risk
Research 1998;1:15–44.
[33] Rosa EA. The logical structure of the social amplification of risk framework
(SARF); metatheoretical foundations and policy implications. In: Pidgeon N,
Kasperson RE, Slovic P, editors. The social amplification of risk. Cambridge,
UK: Cambridge University Press; 2003. p. 47–79.
[34] Sahlin N-E. On higher order beliefs. In: Dubucs J-P, editor. Philosophy of
probability. Dordrecht: Kluwer Academic Publishers; 1993.
[35] Sandin P. Dimensions of the precautionary principle. Human and Ecological
Risk Assessment 1999;5:889–907.
[36] Singpurwalla N. Reliability and risk. A Bayesian perspective. New Jersy:
Wiley; 2006.
631
[37] Vatn J. Societal security—a case study related to a cash depot. In: Aven T,
Vinnem JE, editors. Risk, reliability and societal safety, vol. 3. London: Taylor
& Francis Group; 2007. p. 2599–607.
[38] Vercelli A. From soft uncertainity to hard environmental uncertainty.
Economie applique0 e 1995;48(2):251–69.
[39] Verma M, Verter V. Railroad transportation of dangerous goods: Population
exposure to airborne toxins. Computers & Operations Research 2007;34:
1287–303.
[40] Weick K, Sutcliffe KM. Managing the unexpected. San Francisco: Jossey Bass;
2001.
[41] Willis HH. Guiding resource allocations based on terrorism risk. Risk Analysis
2007;27(3):597–606.
[42] Zio E. An introduction to the basics of reliability and risk analysis. London:
World Scientific; 2006.
[43] HSE. Reducing risk, protecting people. Health and Safety Executive UK,
London: HSE books; 2001.
[44] Aven T. On the precautionary principle, in the context of different
perspectives on risk. Risk Management: an International Journal 2006;8:
192–205.