I have previously used risk and consequence to assess the seriousness of project risks. How does the INFFER process of scoring threats relate to that approach?
The risk and consequence approach breaks down the assessment of project risks into two components: the probability that an adverse outcome will occur (risk, scored as almost certain, very likely, likely, , rare) and the seriousness of that outcome if it does occur (consequence, scored as catastrophic, major, moderate, minor, insignificant). While this can be a useful vehicle for structuring thinking about the riskiness of a project in certain circumstances, it does not suit the needs of INFFER. One reason for this is that it characterises the consequence as a binary variable: a certain level of damage, versus no damage at all. It is assumed that a certain probability can be assigned to the specified level of damage, and it implicitly assumes that the rest of the probability is assigned to no damage. In reality, a particular threatening process may have a range of possible damage consequences, each with a subjective probability level. Zero damage is probably very unlikely in most natura
