Paladin Risk Tip - How Likely is Likely?

Assessing the level of likelihood for risk is something Paladin have been questioning for some considerable time.

They have followed the conventional wisdom up until this point and used the ‘traditional’ criteria to express likelihood.

You may have criteria similar to the following:

Likelihood score
How often might it/does it happen
1 Rare This will probably never happen/recur
2 Unlikely Do not expect it to happen/recur but it is possible it may do so
3 Possible Might happen or recur occasionally
4 Likely Will probably happen/recur, but is not a persisting issue/circumstances
5 Almost certain Will undoubtedly happen/recur, possibly frequently


Uncertainty Statement
> 80% Almost certainly 5
61-80% Probable 4
41-60% Improbable 3
21-40% Unlikely 2
1-20% Highly unlikely 1


Almost certain 0 – 12 months 95% – 100% The event is expected to occur
Likely 1 – 3 years 65% – 95% The event will probably occur
Possible 3 – 6 years 35% – 65% The event might occur at some time
Unlikely 6 – 10 years 5% – 35% The event could occur at some time but is improbable
Rare Beyond 10 years < 5% The event may occur only in exceptional circumstances


These descriptors, whilst standard across the industry, have not sat well for some time. That was until recently when it hit me like the proverbial ton of bricks. It makes absolutely no sense to assess the likelihood of events that are not time or frequency dependent using time or frequency as the measure.

Paladin started to ask – is this an appropriate measure to determine the likelihood of risks such of these?

  • Contaminated food served to restaurant patrons
  • Worker exposed to unbonded/friable asbestos
  • Wrong medication administered to a patient
  • Explosion at fuel storage depot
  • Legionnaires outbreak in the hospital
  • Unauthorised release of, or alteration to client confidential information

Read the full article online here.

So how likely is likely? Understand the effectiveness of your controls to truly understand how likely it is that the risk will materialise as an issue.