A rather standardized approach to assessing and managing risks has evolved, and I propose to call it ordinary risk management (ORM). One might ask, do I mean the management of ordinary risks or the ordinary approach to managing risks. In fact, I would accept both interpretations – ORM encapsulates the particular approach to risk management that has come to be accepted as ordinary and, whatever its virtues more generally, ORM is at its best when applied to the management of ordinary risks.

Applying ORM to particular risk situations involves characterizing the hazards and their likelihood, making decisions about what actions to take to avert the hazards or mitigate the harm, and implementing those actions; that is, it involves risk assessment, decisions under risk, and risk management.

Risk assessment

Risk assessment for ORM typically defines risk as the probability of a specific hazard occurring. For example, the risk of aircraft accidents can be expressed as the number of accidents (or the number of casualties, or deaths) per million flights (or billion flight-miles). Risk can be expressed in many ways, so long as it addresses the likelihood of a specified hazard. One can use the methods of science, mathematics, engineering, and statistics in order to characterize and estimate risks. The intent is to measure or estimate risk objectively, so that different people can take the same data and come up with a similar assessment of the risk.