Risk has two components:
1. uncertainty, and
If either is not present, there is no risk.
Suppose a man jumps out of an airplane with a parachute on his back. He may be uncertain as to whether or not the chute will open. He is taking risk because he is exposed to that uncertainty. If the chute fails to open, he will suffer personally.
Now suppose the man jumps out of the plane without a parachute on his back. If he is certain to die, he faces no risk. Risk requires exposure and uncertainty.
A synonym for uncertainty is ignorance. We face risk because we are ignorant about the future. After all, if we were omniscient, there would be no risk. Because ignorance is a personal experience, risk is necessarily subjective. Consider another example:
A man is heading to the airport to catch a flight. The weather is threatening, and it is possible the flight has been canceled. He is uncertain as to the status of the flight and faces exposure to that uncertainty. His travel plans will be disrupted if the flight is canceled. Accordingly, he faces risk.
Suppose a woman is also heading to the airport to catch the same flight. She has called ahead and confirmed that the flight is not canceled. She has less uncertainty and faces lower risk.
In this example, there are two individuals exposed to the same event. Because they have different levels of uncertainty, they face different levels of risk. Risk is subjective.
Risk is a personal experience, not only because it is subjective, but because it is individuals who suffer the consequences of risk. Although we may speak of companies taking risk, in actuality, companies are merely conduits for risk. Ultimately, all risks which flow through an organization accrue to individuals—stockholders, creditors, employees, customers, board members, etc.