Risk is everywhere. Here is how to measure it, understand it, and communicate it.

By Stef De Reys, PhD, expert trainer of Practical Statistics Course for Medical Affairs: Interpretation & Application

Besides dealing with efficacy data, Medical Affairs professionals are also concerned with safety data. Every clinical trial produces adverse events data. In treating patients, the benefit–risk discussion is never far away. If you have asthma, cold air puts you at risk of exacerbation. In heart failure, fluid overload may raise the risk of hospitalisation. 

That sounds straightforward. In practice, however, risk data are one of the most consistently misread categories of statistics in medicine. A single number, taken out of context, can make a manageable safety signal sound catastrophic, or disguise a serious one behind a reassuring percentage.

This insight gives you a start in understanding: what risk actually is, how to measure it, how to test whether a difference is statistically real, and how to communicate it in a way that supports honest benefit–risk thinking.
 

⚖️ The basics first – what is risk aka absolute risk?

In everyday language, risk is synonymous with danger. In statistics, it means something more precise: the probability that a specific event occurs in a defined group of people over a defined period of time.

Risk is always a proportion. It is a number between 0 and 1 — or expressed as a percentage between 0% and 100%. It answers one question:

Out of all the patients in this group, how many experienced this event?

We call this risk the absolute risk. A risk of 0.05 means 5 patients out of 100 experience the event. When, in a vaccine group, 144 patients suffer from headache out of 400 total patients, the absolute risk is 36% (i.e. 144/400=0.36). So absolute risk assessment – as from an AE table from a randomised trial - is straightforward and simple.

In addition, that simple calculation has important statistical consequences.

A proportion has a known mathematical structure: it has a numerator (the number of events) and a denominator (the total number of patients)¹. Because of that structure, you do not need complex software to quantify the uncertainty around it. The 95% confidence interval follows directly from the binomial distribution, and can be approximated using a straightforward formula.

In the headache example above: 144 patients suffer from headache out of 400 patients.

• Absolute risk: 144/400=0.36 thus 36%
• 95 % confidence intervals: [ 31.3% , 40.7% ]

This tells you that the true headache rate in the vaccinated population plausibly lies between 31.3% and 40.7% — a reassuringly narrow interval, because the sample size of 400 is reasonably large.

In another trial, 9 patients out of 25 suffer from headache. The absolute risk is the same.

• Absolute risk: 9/25=0.36 thus 36%
• 95 % confidence intervals: [ 17.2% , 54.8% ] are much larger now.

The sample size for risk calculation (denominator) is and remains important. A larger sample size increases our confidence.

¹ Importantly, both numerator and denominator are needed. Most often, numerators are cited in medical literature and communication and the denominator is sometimes overlooked.
 

📊 Beyond the basics – comparing Risks

When you compare two risks, you can express the comparison in two fundamentally different ways:

• as an Absolute Risk Difference (ARD): how many more patients were affected.
• as a relative ratio (RR): how many times higher was the risk.

Returning to the above example - headache in the vaccine trial with large sample size:

The Absolute Risk Difference is 36-15 = 21%.

Knowing ARD is knowing reality. There is a real difference of 21% between the vaccine group and the placebo group.

The Relative Risk (RR) means something different. It tells you how many times higher (or lower) the risk is in one group versus another.

The risk of headache is 2.4 (  (36%)/(15%)  ) times higher in the vaccine group than in the placebo group.

The gap between ARD and RR is where most risk communication mistakes are made. Which one sounds the most daunting? That the absolute risk of headache is 21 % higher in the vaccine group or that the risk of headache is 2.4 times higher?

In fact, you cannot compare these numbers and they each serve a different purpose.
 

Use ARD when you want to show real patient impact in absolute terms

This is especially useful in risk-benefit discussions, safety communication, questions from health-care providers about clinical relevance, explaining results to non-statistical audiences or in situations where baseline risk matters. It gives clinical meaning.

In the above example there is a real risk difference of headache of 21%. That is meaningful as you weigh this number vs the potential benefit of the vaccine (vs placebo).

In many instances, this number is also used to calculate how many more patients you can treat (with the vaccine) before the next headache emerges. This is given by the formula:

(NNT) = 1/ARD 

The number needed to treat/harm (NNT or NNH)²  before the next headache in the vaccine group arises is  1/0.21  = 4.8 ≈ 5.

This means that for every 5 patients treated with vaccine rather than placebo, 1 additional headache is expected on average over the same timeframe.

² Often also called NNH: number needed to “harm” as in a risk context, risks are associated with unwanted effects i.e. “harm”. So NNT becomes NNH. It is often a matter of semantics.
 

Use RR when you want to show the strength of the difference between groups

This is especially useful when you want to compare groups quickly, summarise strength of association.

In many tables, abstracts, and literature, relative risks are standard as strength of evidence gained importance. It gives comparative magnitude.

The communication about these stats is less straightforward. Correct statements can be found in the table below:

💡 An example: Which is worse: a sevenfold risk increase or a twofold one?

Consider this scenario. A trial reports two adverse events:

At first glance, fever looks far more alarming. A sevenfold increase sounds like a crisis. A twofold increase sounds manageable. 

This is one of the pitfalls when only one risk statistic (i.e. RR) is reported.

Let’s complete the picture by adding the correct baseline:

You can see that baseline values for headache are much higher. This has consequences:

What is our clinical reality?

Although headache has a lower relative risk (2.39 vs 7.00), it is clinically more burdensome. The absolute impact is 22 extra patients with headache per hundred. For fever, this is only 3 patients per 100. When you vaccinate 5 more patients, you already will see headache. For fever, you need to vaccinate 33 patients before one additional fever occurs. 

In conclusion, although relative risk can show dramatic increases, the real clinical impact can be different. In this example, the 7-fold increase for fever, because of its low baseline, is clinically less severe than for headache.
 

📌 The three-number rule

Never report one risk measure alone.

Always communicate risk using these three together:

• Absolute Risk (AR) in each group — the baseline reality
• Absolute Risk Difference (ARD) — the actual patient impact
• Relative Risk (RR) — the comparative context and strength

Use AR + ARD + RR in that order every time.
 

🔍 Your 15-second risk triage

When you see a safety claim, run this checklist before drawing any conclusion or communicating any finding:

✅ Bottom Line

Risk is everywhere and being able to communicate it well matters from a medical affairs perspective. It is in every safety table, every benefit–risk discussion, every medical education session, and every stakeholder conversation. This does not have to be daunting.

The tools to calculate, understand and communicate about risk are not complex. 

Use them together, report them in order, and risk data stop being intimidating — and start being one of the most powerful tools in your Medical Affairs toolkit.