Other factors should also contribute to the risk value. The EDP audit staffs usually look for both threat and vulnerability in the corporate information systems. Usually, this can take some time to evaluate. Other factors to consider would be the environment that the risk analysis is being conducted. As mentioned above by others, it is quite important to note the degree of harm that can be cause by the failure and if it is high, the risk value would also be deemed high. I know that many companies use the risk value matrix, which provides a method of organizing opportunities based on the end value of each and the risk involved. Then, by carefully determining which risks are wroth taking and which are not, a low of money, time, and effort can be saved. It can also contribute to creating risk values.