A systematic method of determining the potential for a particular threat to occur, based on the likelihood of the occurrence collected from internal staff, past records, and official security records. Calculations: 1) Threats x Vulnerability x Asset Value = Total Risk; 2) (Threats x Vulnerability x Asset Value) x Controls Gap = Residual Risk.
