The social security institution sets out appropriate processes and structures to measure risk.

The measurement of risk consists of assessing the frequency and severity of the risks identified as well as the likely distribution of outcomes. The frequency of a risk is the probability the event will occur; the severity is the financial implication; while the distribution refers to how widely outcomes are likely to vary from the mean expected event.