How to distinguish between 'controllable risks' and 'uncontrollable risks' using first principles?

Good question. If you think about this problem using "first principles," it's actually quite simple. It can help you strip away complex layers and see the essence. Let's not get into complicated definitions; let's talk in plain language.

First principles, in essence, means breaking something down into its most fundamental, core units, until it can't be broken down any further. Then, you build your understanding back up from that root.

So, what's the core of "risk" when you break it down? It really comes down to two things: "probability" and "impact". Any risk cannot escape these two factors: how likely it is to happen (probability), and how big a deal it would be if it did (impact).

Now, let's introduce the factor of "you." The core distinction between "controllable" and "uncontrollable" risks lies in whether you can exert effective influence over these two core units – "probability" and "impact."

Controllable Risks:

These are risks where, through your own actions, you can significantly reduce the probability of something bad happening, or significantly mitigate the impact after it happens.

For example, the risk of "getting into an accident while driving to work".

Breaking it down using first principles:

Reducing Probability: Can you control this? Absolutely. You can follow traffic laws, maintain a safe distance, avoid drunk driving, regularly maintain your vehicle, avoid driving in bad weather, and so on. Every action you take genuinely lowers the probability of an accident.
Mitigating Impact: Can you control this? Yes, you can. You can buy insurance, wear a seatbelt, or purchase a car with higher safety ratings. These measures don't guarantee you won't have an accident, but if one occurs, they can significantly reduce your personal and property damage.

You see, for the risk of "getting into an accident," you can influence both its probability and its consequences. Therefore, for you, it's a controllable risk. You have many "buttons" you can press.

Uncontrollable Risks:

These are risks where, no matter what you do, you cannot significantly alter the probability of something bad happening, nor can you significantly mitigate its impact after it occurs.

Let's take another example: the risk of "a meteorite hitting your car while you're driving to work".

Breaking it down using first principles:

Reducing Probability: Can you control this? Absolutely not. Whether you drive or not, or how you drive, has no bearing on a meteorite's trajectory. The probability of this event is a fixed, external value that you cannot change.
Mitigating Impact: Can you control this? Essentially no. You can't equip your car with anti-meteorite armor, and a seatbelt won't help. If it happens, the consequences are devastating, and you have almost no way to reduce the impact.

You see, for the risk of "a meteorite hitting your car," you can influence neither its probability nor its consequences. Therefore, for you, it's an uncontrollable risk. You can't press a single "button."

To summarize, the way to distinguish them is simple:

When facing a risk, ask yourself two fundamental questions:

Can I do anything to significantly reduce its likelihood of occurring?
Can I do anything to significantly mitigate the damage after it occurs?

If the answer to at least one of these questions is yes, then it falls into the category of a "controllable risk," and you can proceed to manage it.

If the answer to both questions is no, then it's an "uncontrollable risk." For such risks, spending more effort on "prevention" and "control" is futile. The only thing you can do might be to accept it, or simply avoid it (e.g., by not leaving your house at all – though this might introduce new risks).

This way of thinking can help you filter out a lot of noise, allowing you to focus your energy and resources on the areas where you can truly "press the buttons."