Risk comes in many forms and how we perceive it affects what we are prepared to tolerate. The implementation of Health IT itself is associated with different varieties of risk (e.g. security, reputational, financial as well as clinical). Differentiating these allows us to manage them using the most appropriate techniques. The language we use to derive and quantify risk needs to be precise and consistent in order for practitioners to meaningfully debate and evaluate its degree. This chapter examines the nature of risk, the terms used to describe it and the techniques we can harness to quantify it objectively.