Risk analysis terminology for IT-systems: does it match intuition?

Many risk specific concepts like "threat", "consequence" and "risk" belong to the daily language. In a risk analysis one cannot be certain that the participants\´ interpretation of these terms is in accordance with risk analysis definitions. Risk analyses often use brainstorming techniques to identify risks based on the opinions and judgments of system experts. Such techniques employ risk specific terminology, and to avoid misunderstandings and uncertainty among the participants, it is important that the terminology does not conflict with the daily language understanding of these terms. We have developed a formal, conceptual model of IT-system risk analysis terminology and investigated to what extent this model corresponds to the common, or intuitive, understanding of the concepts. The paper reports on the results from a survey conducted among 57 professionals and students.