In risk assessment, how are change severity and change frequency defined?

• A. Change severity is the potential impact if the change introduces a hazard; change frequency is how often the change occurs or is triggered.
• B. Change severity is the expected time between events; change frequency is the cost of implementing a change.
• C. Change severity is the probability of an incident when a change is made; change frequency is the duration of implementing the change.
• D. Change severity and change frequency are unrelated to risk assessment.

Answer: (D)

In risk assessment you look at the potential hazards, their consequences, and how likely they are to happen, not at the rate or direct impact of changes themselves. Change severity and change frequency aren’t standard definitions used to describe risk within this framework. Instead, when a change is proposed, you assess whether it could introduce new hazards or modify existing ones and then evaluate the resulting risk using the usual measures of consequence and likelihood. The frequency of changes or the magnitude of a change’s impact are typically handled through change control and project management, not as defined risk-assessment parameters. That’s why this statement is considered correct: those terms aren’t part of how risk assessment defines or quantifies risk.