Risk assessment is a step in the risk management process. Risk assessment is measuring two quantities of the risk, the magnitude of the potential loss, and the probability that the loss will occur.

Risk assessment may be the most important step in the risk management process, and may also be the most difficult and prone to error. Once risks have been identified and assessed, the steps to properly deal with them are much more programmatical.

Part of the difficulty of risk management is that measurement of both of the quantities in which risk assessment is concerned can be very difficult itself. Uncertainty in the measurement is often large in both cases. Also, risk management would be simpler if a single metric could embody all of the information in the measurement. However, since two quantities are being measured, this is not possible. A risk with a large potential loss and a low probability of occurring must be treated differently than one with a low potential loss but a high likelihood of occurring. In theory both are of nearly equal priority in dealing with first, but in practice it can be very difficult to manage when faced with the scarcity of resources, especially time, in which to conduct the risk management process.

Risk assessment in public health

In the context of public health, risk assessment is the process of quantifying the probability of a harmful effect to individuals or populations from certain human activities. In most countries, the use of certain chemicals, or the operations of certain facilities (e.g. power plants, manufacturing plants) is not allowed unless it can be shown that they do not increase the risk of death or illness above a certain threshold. For example, the American Food and Drug Administration (FDA) required in 1973 that cancer-causing compounds must not be present in meat at concentrations that would cause a cancer risk greater than 1 in a million lifetimes.

How is the risk determined

In the estimation of the risks, two steps are involved, requiring the inputs of different disciplines. The first step, Hazard Identification, aims to determine the probability that an individual receiving a certain dose of the contaminant (chemical, radiation, noise, etc.) will develop an adverse effect. This is done, for chemical hazards, by drawing from the results of the science of toxicology. For different kinds of hazard other disciplines are involved. The complexity of this step derives mainly from the necessity to extrapolate results from experimental animals (e.g. mouse, rat) to humans, and from high to lower doses. In addition, the differences between individuals due to genetics or other factors mean that the hazard may be higher for particular groups, called the susceptible population. To account for the largely unknown effects of these extrapolations, a prudent approach is adopted by including safety factors in the estimate of the hazard, typically a factor of 10 for each unknown step.

The second step, Exposure Quantification, aims to determine the amount of a contaminant (dose) that individuals and populations will receive. This is done by drawing from the results of the discipline of exposure assessment . As different location, lifestyles and other factors likely influence the amount of contaminant that is received, a range or distribution of possible values is generated in this step. Particular care is taken to determine the exposure of the susceptible population(s).

The results of the two steps above are then combined to produce an estimate of risk. Because of the different susceptibilities and exposures, this risk will vary within a population. However, the decisions based on the application of risk assessment must be based on one number only. This problem begs the question of how small a segment of a population must be protected. What if a risk is very low for everyone but 0.1% of the population? Clearly there is a difference whether this 0.1% is represented by

• all infants younger than X days or
• recreational users of a particular product.

In general, the consensus is that if the risk is higher for a particular sub-population because of abnormal exposure rather than susceptibility, this group must not be considered by rules applicable to the general population. It should be protected instead by ad-hoc regulations. This is often the case for workers subject to occupational risk.

Acceptable risk increase

The idea of not increasing lifetime risk by more than 1 in a million has become commonplace in public health discourse and policy. It is not clear how consensus settled on this particular figure. In some respects, it has the characteristics of a mythical number. In another sense, it provides a numerical basis for what to consider a negligible increase in risk. Compare for example the 1 in a million increase in cancer risk of many regulations with the typical 1 in 4 lifetime risk of death by cancer in developed countries.

It may be tempting to advocate the adoption of a zero-risk policy. After all, the 1 in a million policy would still cause the death of hundreds, or thousands, of people in a large enough population. In practice, however, a true zero-risk is possible only with the suppression of the risk-causing activity. More stringent requirements, or even the 1 in a million one, may not be technologically feasible at a given time, or so expensive as to render the risk-causing activity unsustainable.

In the interest of public health, the risks vs. benefits of the possible alternatives must be carefully considered. For example, it might well be that the emissions from hospital incinerators result in a certain number of deaths per year. However, this risk must be balanced against the available alternatives of no incineration (with the potential risk for spread of infectious diseases) or even no hospitals. Unless or until creativity and technological development offer superior methods for hospital waste disposal, the choice, based on risk assessment, must be that of the lesser evil. One risk number alone is never sufficient to make an informed decision.

See also

• Risk management