I went into details of generic stochastic risk modeling, which was totally unnecessary. They wanted to hear "the product of the probability of something bad happening times the impact of the bad thing".