I'm looking for perspectives on how risk analysis is performed when there's not precisely a "dollar value" associated with the risk, as in an Open Source project. Traditionally, risk analysis takes the form of
Asset Value X Annual Probability of Loss X Probable Outcome of Loss = Risk
Open source community driven projects provide great value to people, and their development faces significant risks, both from a project standpoint (ranging from wasted developer cycles to failure to ever deliver) and from a product standpoint (users could not like the product, and update could make people leave or a security hole could leave millions of systems vulnerable to a nasty malware attack). Nevertheless, it doesn't quite lend itself to this formula.
Who is responsible for identifying and managing these risks in Open Source community driven projects? How does the team decide which risks are most significant to the outcome of the project? Are there any official standards or approaches in this area?
In the case of adopting Open Source, I believe this question has some solid answers:
On the other hand, I don't see any literature or voices speaking to this aspect of the creation of such software. Any input from people actively involved in this community?