What is the formal definition of risk as a single number?

Risk = Eintrittshäufigkeit × Schadensausmass — frequency of occurrence × magnitude of damage.

The standard formula, with units:

• Eintrittshäufigkeit (occurrence frequency): [# / year]
• Schadensausmass (damage magnitude): [CHF] — value of the exposed assets
• Risiko (risk): [CHF / year] — an annualised expected loss

So a threat that hits once per 10 years and causes CHF 1 M of damage carries a risk of CHF 100k/year. A nuisance that hits 10× per year and costs CHF 100 carries CHF 1k/year — the rare-but-catastrophic event is the bigger problem.

Why this matters:

• Comparability: annualised CHF lets you compare a flood risk with a phishing risk on the same axis.
• Budgeting: if a control costs CHF 50k/year and reduces a CHF 100k/year risk, you've broken even on math grounds.
• Limits: the formula is an expected value — it hides variance. A 1% chance of CHF 100M loss is the same expected loss as a 10% chance of CHF 10M, but the first can bankrupt you.