Answer:
Risk assessment is one of the steps used in a risk management process. The risk R is assessed by measuring the two parameters that determine it, the magnitude of the possible loss or damage L, and the probability p that said loss or damage will occur. According to ISO 31000, the Risk Assessment actually refers to the Risk Assessment.
Risk assessment is probably the most important step in a risk management process, and also the most difficult and most likely to make mistakes. Once the risks have been identified and evaluated, subsequent steps to prevent them from occurring, protect against them or mitigate their consequences are much more programmatic.
Part of the difficulty in risk management is that measuring the two parameters that determine risk is very difficult, which is why it is said to be a subjective process. The uncertainty associated with the measurement of each of the two parameters (L and p) is usually large. Risk management would also be simpler if it were possible to have a single metric that reflects all available information in the measurement. However, this is not possible, since it is about measuring two quantities. A risk with great magnitude of loss or damage and a low probability of occurrence must be treated differently than a risk with a reduced magnitude of loss or damage and a high probability of occurrence. In theory the two indicated risks have an identical priority for their treatment, but in practice it is quite difficult to manage them when faced with limitations in the available resources, especially time to carry out the risk management process.
