To understand how to measure risk, we need to first understand what drives risk. Risk drivers are the fundamental global and domestic macroeconomic and industry factors that create risk.

- All risks come from uncertainties.
- Financial risks come from fundamental factors in macro-economies and industries.
- There are systematic risks and unsystematic (diversifiable) risks.

Risk management can control some risks but not all.

Common measures of risk:

- Probability
- Standard deviation: measures dispersion in a probability distribution. This has significant limitations.
- Beta: measures the sensitivity of a security's returns to the returns on the market portfolio.
- Measures of derivatives risk: delta, gamma, vega and rho.
- Duration measures the interest rate sensitivity of a fixed income security.
- Value at Risk: measures the potential loss in value of a risky asset or portfolio over a defined period for a given confidence interval. If the VaR on an asset is $100 million at a one-week, 95% confidence level, there is only a 5% chance that the value of the asset will drop more than $ 100 million over any given week.
- CVaR: scenario analysis and stress testing, can be used to complement VaR.

It is difficult to measure rare events such as operational risk and default risk.

There are four broad categories of risk modification.

The primary determinant of which method is best for modifying risk is weighing the benefits against the costs, with consideration for the overall final risk profile and adherence to risk governance objectives.