What are the three components typically evaluated in a basic risk assessment for a facility?

• A. Weather; Training level; Security budget.
• B. Legal compliance; Public perception; Facility age.
• C. Threat likelihood, impact/severity, and existing controls or mitigations.
• D. Budget, personnel availability, and time to implement.

Answer: (C)

The essential focus in a basic facility risk assessment is to understand what could happen, how bad it would be, and what protections are already in place. The three core components are threat likelihood, the potential impact or severity, and the existing controls or mitigations.

Thinking through it: threat likelihood answers how probable a given threat is to occur. Impact or severity describes the extent of harm, damage, or disruption if the threat materializes. Existing controls or mitigations assess what safeguards are already in place and how well they reduce either the chance of the threat happening or the severity of its effects. Combining these three elements lets you estimate the residual risk after controls and prioritize where to strengthen defenses.

Other factors like weather, training level, or budget might influence risk but aren’t the three fundamental evaluative dimensions used to quantify risk in a basic assessment.