John is a risk assessment specialist. Recently, his company’s vulnerability analyst identified a vulnerability in a crucial system that the company relies on for its operations. John needs to assess this risk to determine whether it requires urgent attention. 

Which equation should John use to calculate the risk value?