Risk is a full-bodied presence in the boardroom and the C-suite, so it’s time risk management stopped being two-dimensional. Let’s add a third dimension to risk measurement.

And, while we’re doing that, it’s time to stop confusing risk measurement and risk anticipation with risk management.

For years, the twin pillars of risk management were probability and impact: What are the odds an event will happen? What will the damage or the benefit be if it does happen? Hence the attempts to determine what were high- or low-frequency events, and to distinguish what would cause minor losses and what would put a ...