what are the three dimensions of risk management?

Risk management frameworks vary by industry and standard, so "the three dimensions" is not a single universally fixed list — but a commonly cited framework breaks risk management down into three core dimensions: likelihood (probability), impact (severity/consequence), and time horizon (or exposure/velocity). These three factors are combined to assess and prioritize risks: how likely an event is to occur, how severe its consequences would be if it did, and over what timeframe or how quickly it could develop.

A related and equally common way of framing "three dimensions" comes from the risk management process rather than risk assessment criteria. In this view, the three dimensions are:

1. Risk Identification – recognizing and documenting potential risks that could affect an organization, project, or objective.
2. Risk Assessment (or Analysis) – evaluating identified risks in terms of their likelihood and potential impact, often to prioritize which risks need the most attention.
3. Risk Response (or Mitigation/Treatment) – deciding how to handle each risk, typically through strategies such as avoidance, reduction/mitigation, transfer (e.g., insurance), or acceptance.

Some frameworks add a fourth stage — monitoring and review — turning this into a four-step cycle rather than three fixed dimensions, which is why the "three dimensions" label isn't perfectly standardized across sources.

Other disciplines define "three dimensions" differently depending on context. For example, in enterprise risk management (ERM), some models describe dimensions as strategic, operational, and financial risk; in project management, they may be framed as scope, schedule, and cost risk; and in cybersecurity, as confidentiality, integrity, and availability.

Because terminology differs by field and organization (ISO 31000, COSO ERM, PMI, etc.), if you're working within a specific framework or textbook, it's worth checking that source's exact definition, since the "three dimensions" phrase may refer to a particular model's terminology rather than one universal standard.