Re: Risk Management - Probability vs. Frequency
Accurately estimating probability (or frequency) can be difficult so in most cases this is purely a "theoretical" discussion.
ISO 14971 specifically states that risk is based on the probability of harm.
The correct parameter is frequency (average events per period), to account for events that occur at a frequency > 1. Since probability cannot exceed 1, under ISO 14971, all events with a frequency exceeding one are treated as having the same "risk". So for example a minor burn that occurs 100 times a year has the same "risk" of a minor burn that occurs 1-2 times a year.
Obviously, in this extreme example no-one would consider the risk the same. But I have seen cases where risks that are different by factors of 10 are considered treated the same.
Also, this can also cause errors if there is a sequence of events, and overall probability of harm is based on product of each probability. Again if one of the intermediate events occurs a frequency greater than 1, the result may underestimate the risk.
The potential for "error" increases as the unit for time increases. Calculations based on per use or per day are usually OK, but calculations on a per year or per lifetime might have problems.
Obviously, risk should be risk no matter what units are used. Units are just for convenience. The ratio of risk for event A vs event B should be constant no matter what units are used. If frequency is used, the ratio never changes. But if probability is used, it can change ...