Which formula can be used to define risk?

According to the CDCP Preparation Guide1, risk can be defined as the product of impact and probability. Impact is the measure of the negative consequences or losses that may result from a risk event, such as downtime, data loss, or damage to the data centre. Probability is the measure of the likelihood or frequency of a risk event occurring, based on historical data, expert judgment, or statistical analysis. By multiplying impact and probability, risk can be quantified and compared, which helps in prioritizing and mitigating the risks. For example, a risk event that has a high impact but a low probability may have the same risk level as a risk event that has a low impact but a high probability.