Risk-Adjusted Value

Expected cost of failures

Include the expected cost of failure modes: probability times impact for incidents such as wrong payments, data exposure, compliance breaches or a failed integration. Some risks are small but severe; mitigate them (review thresholds, limits, audits) and include the mitigation cost. A project with a slightly lower NPV but much lower tail risk can be the better choice. Decision makers appreciate seeing risks addressed rather than hidden.

A simple risk register

Expected annual cost = probability x impact.

risk                                   probability/yr   impact     expected cost   mitigation
duplicate payment slips through        10%              $20,000    $2,000          amount limits + review
supplier bank detail fraud missed      2%               $150,000   $3,000          change-of-details check
provider model change breaks extraction 30%             $8,000     $2,400          eval suite, pinned versions
integration outage (1 week manual)     20%              $6,000     $1,200          fallback to manual queue

Show mitigations with costs

For each major risk, show the control and its cost; it turns objections into a plan.

Quick check: How is the expected cost of a risk calculated?

• Probability times impact
• Impact divided by volume
• Probability alone
• The largest possible loss only