Risk seems to encompass:
i) volatility (how much the price of an asset fluctuates);
ii) holding power (whether an investor can hold on to an asset for a certain period of time);
iii) the probability of the permanent loss of capital (what happens at the end, the final payout).
If an investor is patient, smart, and attentive, volatility works in her favor. She understands value, so can quickly buy when prices are depressed and sell when prices are elevated. Yet this depends on holding power, which can be contractual or psychological. Since no one can time the exact bottom, an investor needs to buy and hold on, either till the price swings back up temporarily (volatility) or till the end when the price converges to the final value. If an investor takes outside debt or equity and these providers pull out before the upswing or value convergence, she does not have contractual holding power. If she can't stomach the risk mentally, she does not have psychological/emotional holding power. All three are linked: vol, duration/holding power, and final payout probabilities all matter in defining risk. I'm not sure if there is a single equation or metric that can capture it all (VAR, cVAR, drawdowns, etc.).
As Vega notes, models and risk managers failed horribly, for many reasons. The most honest explanation I've seen of this failure came from an anonymous article by a risk manager at a big investment bank, here: Confessions of a Risk Manager. As the risk manager notes, multiple assumptions about risk were wrong. Flawed models failed. And incentives were skewed, allowing traders to take on much risk and get the upside, but neither trader nor risk manager bore a share of the downside (heads I win $10 million, tails the bank loses $10 billion).
The saddest part of this are the reports of the major bank heads, who had no clue about the risk being taken in their firms. This happened even at the best firms, and continues today. For example, the CFO of Goldman Sachs, Jeff Viniar, commented in late 2007 regarding one fund that: “We were seeing things that were 25-standard deviation moves, several days in a row. There have been issues in some of the other quantitative spaces. But nothing like what we saw last week.” This statement shows that at least one bank head doesn't understand risk, since a 25-standard deviation event is only supposed to occur once a few million years (i.e. never). I talked to one banker today, who mentioned that the largest investment banks in the US and Europe (including his own - one of the world's largest) are fully insolvent. They haven't taken anywhere near the amount of losses on their assets to reflect reality. They can't, because that would show their insolvency. So if they can't acknowledge reality, how can they acknowledge risk and uncertainty?
To end, Frank Knight's distinction in Risk, Uncertainty, and Profits is important:
Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. . . The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomenon depending on which of the two is really present and operating. There are other ambiguities in the term "risk" as well, which will be pointed out; but this is the most important. It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an unmeasurable one that it is not in effect an uncertainty at all. We shall accordingly restrict the term "uncertainty" to cases of the non-quantitative type. (emphasis added, I.I.26)
Basically, the difference between risk and uncertainty is:
i) risk = a measurable, finite set of outcomes, with probability and magnitude known;
ii) uncertainty = an unmeasurable set of outcomes, where either one or both, probability and magnitude are not known, or the set isn't finite; hence anything not "risk."
Unfortunately, the line between the two isn't often clear.