I am trying to define some concepts of risk management and I am having some trouble. I am using definitions from ISO 73:2009 and from "A. Avizienis, J-C Laprie, B. Randell, and Landwehr. Basic concepts and taxonomy of dependable and secure computing."
I would like to use the concept of dependability, but link it with hazards and not service failures. Is it correct to write the following?
A risk is defined as the effect of uncertainty on objectives. It is often associated with events, their likelihood, and their consequences. Wether they are positive or negative.
A hazard is a source of potential harm. It can have the potential to give rise to a risk.
A service delivered by a system is its behavior as it is perceived by its user. Correct service is delivered when the service implements the system function.
A service failure, or simply failure, is an event that occurs when the service delivered by the system deviates from correct service.
The dependability of a system is the ability to avoid service failures that are more frequent and more severe than is acceptable.
The goal of risk assessment is to minimize hazards by reducing the risk of service failure and therefore to increase the system dependability.