Making Decisions
At the core of risk management is making decisions about what to do when there are risks. This depends on how the risk is valued. For example, you might want to do a cost benefit analysis where you compare the costs of implementing the risk mitigation with the benefit of having averted the risk.

Alternatively you might want to decide whether the volatility of a portfolio of shares is compensated by the higher expected return.

Classic decision theory says you work out a quantity called the expected utility and choose the option which maximises this.

In practice people don't take decisions that way. Instead they seem to be more concerned with the downside than could be explained by any reasonable utility function. This may be becasue of the way they value downsides such as their company going bankrupt or losing their job. Indeed the risk-reward expectations of investors might be explained by the disutility of worry.