Two Dimensional
In the risk world, “consequences x likelihood” is a familiar equation. But perhaps this isn’t a useful measure. Consequences aren’t predictable. Also, consequences can be cumulative: if the concern is power outage, the length of that outage is a factor to be considered.
Likelihood has the same problem: if something hasn’t happened, its likelihood is unpredictable.
Complicating the risk equation is the complexity of it and the language around risk. Risk, in many ways, has become overintellectualized.
For example, “not enough staff” is not a risk, but could rather be a certainty.
Some “risks” are just circumstances to be managed.