A big problem evaluating a risk is the stochastic nature risks have. Some risk happens every time other risks only happen once every 10,000 products send. An also the level changes from time to time. So when you are deciding a specific protection level you have to determine how much security you want to build in to your system.
Let us take an example of drop height from a specific parcel.
In a few cases nothing happens and in a majority of cases you can detect a low basic impact on almost all shipments. Then maybe only in one out of ten you can measure more than the basic impact and very seldom you are able to measure extreme impact.
You can never determine a protection level giving you 100% security.
You must always live with losses – high or low.