A risk measure is a tool (mathematical, statistical, etc.) that is used to assess and determine the amount of risk involved in a position/ an asset/ a set or basket of assets or investments/ a firm, etc. Risk measures vary from the simplest to the most sophisticated. Simple measures include variance and covariance (between an asset and other assets in a portfolio). Sophisticated measures encompass, for example, the value at risk (VaR) and the so-called coherent risk measures.

A risk metric is the concept being quantified by a specific risk measure. A risk metric provides an interpretation of the number calculated and assigned to the underlying risk. Selection of a risk metric depends on the aspect of perceived risk to assess such as probability of default (POD), volatility, amount of loss (VaR), etc.

Generally speaking, a risk measure is a calculation process that assigns a specific value to a risk/ risk factor. In this sense, it differs from a risk metric, which is the attribute of risk that is being measured using a risk measure.

Risk metrics typically take one of three forms: 1) metrics that quantify risk exposure, 2) metrics that quantify uncertainty, and 3) metrics that quantify both exposure and uncertainty. Probability of loss is a risk metric that only quantifies uncertainty (as to probability of occurrence of loss), but it does not address a firm’s exposure to this risk , which depends upon whether or not it has the proper arrangements/ preparations/ plans in place. For example, credit exposure is a risk metric that only quantifies exposure. It reflects the amount of money a firm might lose if a counterparty (a debtor) would default on its debt. It tells nothing about uncertainty as to whether or not the counterparty will end up in default.

Risk metrics that quantify uncertainty—either by their  own or along with exposure—are usually based on probabilities. Such risk metrics often reduces risk to a single parameter of a probability distribution. Standard deviation of tomorrow’s spot price of a security is a risk metric that quantifies uncertainty (about future performance). Average insurance claims for total number of the insured is a risk metric that quantifies both uncertainty and exposure (as reflected in the mean of a probability distribution).