Almost every risk program uses the basic idea of risk magnitude and risk frequency to make decisions about how seriously the organisation should take those events, and how heavily they should invest in them.