McKinsey & Company interview question

How to set up metrics for quantifying risks?