← Years 9–10 Digital Systems

Risk as likelihood and impact

Risk is how likely a threat is to succeed combined with how much harm it would cause. Rate each as low, medium or high to decide which risks matter most.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 71, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 18, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 17, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 139, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 49, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 31, WA Computer Science ATAR Year 11 — Cyber Security — Module 11

Understanding Risk as likelihood and impact in Years 9–10 Digital Systems

What it does: A high impact rating means a lot of harm, such as losing every student's records or being locked out of a system for days. The threat (phishing) is the same, but the harm to the admin account is much bigger, so its risk is higher. Risk combines likelihood and impact. A threat alone does not tell you how risky something is. Impact is about the size of the harm: lost data, money, time or trust. How often attackers try is about likelihood. Likelihood is rated low, medium or high based on how probable it is that the threat will succeed.

Common mistakes: Impact is rated low, medium or high. "often" describes how frequently something happens, which is likelihood. It should be impact <- "medium". Risk combines likelihood AND impact. Multiplying likelihood by itself ignores how much harm the threat would cause. It should be risk <- likelihood x impact.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Risk as likelihood and impact to a class →

This module's key terms are also in a printable crossword (Modules 70–79) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which describes risk in cyber security?
How likely a threat is to succeed combined with how much harm it would causeOnly how many hackers exist in the world
Matches
likelihood = "high", impact = "low", so risk = "ignore it"
↓
Risk is not decided by likelihood alone. Even a low-impact threat that is very likely still needs a rating and some attention.
Applying
Meanings
Term
risk = likelihood x impact
Meaning
Risk is how likely a threat is to succeed combined with how much harm it would cause. Rate each as low, medium or high to decide which risks matter most.
Practice
threat <- "stolen password"
Testing
Gaps
risk = x impact
Check Answer
Spots
2likelihood <- "high"
3impact <- "often"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Roadrunner' badge — Streak Runner, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which describes risk in cyber security?
A. How likely a threat is to succeed combined with how much harm it would cause ✓
B. Only how many hackers exist in the world
Risk combines likelihood and impact. A threat alone does not tell you how risky something is.
2. A threat is very likely to happen and would cause severe harm. What is the risk rating?
A. High risk ✓
B. Low risk
High likelihood and high impact together make a high risk, so it needs attention first.
3. A threat is very unlikely to succeed and would cause only minor harm. What is the risk rating?
A. High risk
B. Low risk ✓
Low likelihood and low impact together make a low risk. It can wait while bigger risks are dealt with.
4. Which question helps you rate LIKELIHOOD?
A. How much money would we lose?
B. How easy or common is this attack? ✓
Likelihood is about the chance of the threat succeeding. How much would be lost is a question about impact.
5. Which question helps you rate IMPACT?
A. How much harm would it cause if it worked? ✓
B. How often do attackers try this?
Impact is about the size of the harm: lost data, money, time or trust. How often attackers try is about likelihood.

Match the Pairs

risk = likelihood x impact → Risk combines how likely a threat is to succeed with how much harm it would cause
likelihood = "high" → The threat is very likely to succeed, for example because it is common or the defences are weak
Impact is rated by how much harm a successful attack would cause → impact = "high"
The same threat can have different risk for different assets → phishing on school wifi password: risk = low phishing on admin account: risk = high
likelihood = "high", impact = "low", so risk = "ignore it" → Risk is not decided by likelihood alone. Even a low-impact threat that is very likely still needs a rating and some attention.
Phishing has the same risk for every asset, so rate them all the same → Risk depends on the asset. The same threat can cause far more harm to one asset than to another.

Key Term

risk = likelihood x impact
Risk is how likely a threat is to succeed combined with how much harm it would cause. Rate each as low, medium or high to decide which risks matter most.

Fill in the Blanks

1. risk = likelihood x impact
Hint: Type the factor that says how likely the threat is to succeed.
2. # Harm if the attack works risk = likelihood x impact
Hint: Type the factor that measures how much harm the threat would cause.
3. risk = likelihood x impact
Hint: Type the letter that combines the two factors in the risk formula.
4. IF asset = "student records" impact = "high" risk = likelihood x impact
Hint: Type the keyword that starts a condition so the same threat can be rated differently for each asset.
5. likelihood = "medium" impact = "high" risk = likelihood x impact
Hint: Type the variable name that holds the harm rating, as used in the risk formula.

Spot the Error

Question 1
A threat <- "phishing email"
B likelihood <- "high"
C impact <- "often"
D risk <- "high"
Line C — Impact is rated low, medium or high. "often" describes how frequently something happens, which is likelihood. It should be impact <- "medium".
Question 2
A likelihood <- "low"
B impact <- "high"
C risk <- likelihood x likelihood
D OUTPUT risk
Line C — Risk combines likelihood AND impact. Multiplying likelihood by itself ignores how much harm the threat would cause. It should be risk <- likelihood x impact.
Question 3
A asset <- "exam results"
B impact <- "low"
C likelihood <- "medium"
D risk <- "high"
Line B — If exam results were leaked or changed, the harm would be serious, so the impact is high, not low. It should be impact <- "high".
Question 4
A risk <- likelihood - impact
B IF risk = "high" THEN
C OUTPUT "Fix this first"
D ENDIF
Line A — Risk combines likelihood and impact (likelihood x impact). Subtracting one from the other is not how risk is worked out. It should be risk <- likelihood x impact.
Question 5
A threat <- "daily phishing"
B likelihood <- "low"
C impact <- "medium"
D risk <- "high"
Line B — A threat that shows up every day is very likely to be tried, so its likelihood is high, not low. It should be likelihood <- "high".

Student with a class code? Join your class →