Giving information about the threat, the vulnerability, the probability of the threat, and the impact (based on the confidentiality, the integrity, and the availability), you can calculate the risk level.