The formula Risk = Importance x Liklihood is not mathematically valid

The likelihood is a probabilistic value with a mean, mode, median and a probability distribution function (Triangle is a popular risk assessment one).

The Importance is a Cardinal Value with an uncalibrated value. In the absence of the financial, operational, or other “impact” assessment.

These two variables can not have the multiplication operator between them. This is a popular error found in almost every risk management book except those used by defense, NASA, Nuclear Power and insurance industries. By this I mean the software development industry is the only one using this incorect formula, including PMI.

One good starting point is http://www.sei.cmu.edu/risk/dod-risk.pdf. Here a 5×5 matrix is developed where the definitions of the various riks probabilities and impacts are built for each class of risk.