Riskis defined as theeffect of uncertainty on objectives, encompassing both positive opportunities and negative outcomes.
* Definition:
* In GRC and risk management, risk is the combination of the likelihood of an event and its consequences.
* Measurement:
* Risk quantifies the potential negative impact on objectives due to uncertainty.
* Why Other Options Are Incorrect:
* B(Harm): Refers to physical or psychological damage, not a risk metric.
* C(Obstacle): Refers to a challenge or barrier, not the overall concept of risk.
* D(Threat): Represents a potential source of risk, not the measure itself.
References:
* ISO 31000 (Risk Management): Provides a formal definition of risk and its relationship to uncertainty.
* NIST RMF: Emphasizes risk management as a function of organizational objectives.