I do agree with the comment above, how severe a failure is by looking at the nature of the harm is a very important aspect. In addition, other factors that may potentially determine risk would be:
1) Vulnerability- which relates to the impact and likely hood of failure to occur, the more vulnerable the entity is to risk, the higher the impact it would have if the event occurs
2) Speed of onset – refers to the time it takes for a risk event to manifest itself or in other words the number of occurrences between each case. This aspect is important in order to develop risk response plans.
3) Scenario analysis – useful in assessing risks and tying them to strategic objectives. Essentially this refers to how the effects of technology, natural gas, oil, currency changes, competitive pressure, and supply chain disruption would impact risk.
I attached a link to a document that refers to these risk assessment factors

http://www.coso.org/documents/COSOAnncsOnlineSurvy2GainInpt4Updt2IntrnlCntrlIntgratdFrmwrk%20-%20for%20merge_files/COSO-ERM%20Risk%20Assessment%20inPractice%20Thought%20Paper%20OCtober%202012.pdf