I have been asked to testify about threats to information systems. As in most of the things I will say here today, other experts may hold slightly different views, and this does not make either their views or mine invalid. It just reflects the lack of standards and common usage in the information protection profession. Risk results from the combination of threats, vulnerabilities, and consequences. Without consequences, threats are of no import, and without vulnerabilities, threats can do no harm.
Risk is managed by a combination of mitigation strategies and risk-taking.
To me, risks ultimately have to do with harming people. If no human being is harmed, I am not interested. I don't care if a computer gets blown up unless there is a negative impact on a person. That's why my field is called information protection. We most commonly deal with issues of integrity, availability, and confidentiality - also called privacy.