The two dimensions of risk

I was hiking in Tiger Mountain Saturday, crossing a log that served as a bridge over the stream 10 feet below. The log had carved "X" notches in it for traction, and was a consistent size end-to-end. The log protruded about three feet past the edges of the embankment for the stream. I noticed that my anxiety (I was carrying Garrett on my back, and I am always careful when others around... like when I drive... but I digress) lessened once I had crossed the chasm, but was still on the log. My risk of falling hadn't lessened, but my risk of injury (to me or Garrett) had lessened.

Ok, not earth shattering (yes you may now address me as Captain Obvious), but it did remind me of the two dimensions of risk. That is:
1. What is the probablity an event will occur?
2. What level of damage can happen if it does occur?

Rarely, when risk is discussed, do people talk about each axis independent of each other. And I rarely do as well. Instead, we lump them together and address. Last year, on my first product at Amazon, I actually broke my risk list into the two dimensions, and thoroughly confused the hell out of everyone, even after I explained what I was doing :) That was kind of strange for a company that loves data.

What's interesting to me is the relationship for #2 between damage and brand strength. One of the key reasons big companies cannot move as quickly as startups is that there is more at stake to lose when a big company screws up. The brand (which carries significant value) can be damaged, deeper pockets means bigger targer for lawyers, etc. As such, for large companies each decision carries a bigger risk component, and in turn more risk mitigation. This notion is often lost on those who have worked for a company during the time a company has grown from a small business into a Fortune 500 company. But it's a valid rationale - there is more at stake for large companies.