Abstract: A method and apparatus for diagnosing system risk are disclosed. A risk diagnosing server extracts from a risk information data base software risk information with which is associated for every item of software, risk level information obtained by quantifying risk estimated from problems that have been verified and sends the software risk information to a client terminal. The client terminal acquires software specifying information that specifies software used on the side of the client terminal, extracts data, conforming to the software specifying information used by the client terminal, from the risk information to perform self-diagnosis, and sends the result of self-diagnosis back to the risk diagnosing server. The latter then outputs the result of this self-diagnosis.