Risk mitigation measures are usually formulated according to one or more of the following major risk options, which are:
- Design a new business process with adequate built-in risk control and containment measures from the start.
- Periodically re-assess risks that are accepted in ongoing processes as a normal feature of business operations and modify mitigation measures.
- Transfer risks to an external agency (e.g. an insurance company)
- Avoid risks altogether (e.g. by closing down a particular high-risk business area)
Later research has shown that the financial benefits of risk management are less dependent on the formula used but are more dependent on the frequency and how risk assessment is performed.
In business it is imperative to be able to present the findings of risk assessments in financial, market, or schedule terms. Robert Courtney Jr. (IBM, 1970) proposed a formula for presenting risks in financial terms. The Courtney formula was accepted as the official risk analysis method for the US governmental agencies. The formula proposes calculation of ALE (annualised loss expectancy) and compares the expected loss value to the security control implementation costs (cost-benefit analysis).
Cost–benefit analysis (CBA), sometimes called benefit–cost analysis (BCA), is a systematic process for calculating and comparing benefits and costs of a project, decision or government policy (hereafter, “project”). CBA has two purposes:
To determine if it is a sound investment/decision (justification/feasibility),
To provide a basis for comparing projects, it involves comparing the total expected cost of each option against the total expected benefits, to see whether the benefits outweigh the costs, and by how much.
CBA is related to, but distinct from cost-effectiveness analysis. In CBA, benefits and costs are expressed in monetary terms, and are adjusted for the time value of money, so that all flows of benefits and flows of project costs over time (which tend to occur at different points in time) are expressed on a common basis in terms of their “net present value.” Closely related, but slightly different, formal techniques include cost-effectiveness analysis, cost–utility analysis, economic impact analysis, fiscal impact analysis, and Social return on investment (SROI) analysis.
Cost–benefit analysis is often used by governments and other organizations, such as private sector businesses, to evaluate the desirability of a given policy. It is an analysis of the expected balance of benefits and costs, including an account of foregone alternatives and the status quo. CBA helps predict whether the benefits of a policy outweigh its costs, and by how much relative to other alternatives (i.e. one can rank alternate policies in terms of the cost–benefit ratio).
Generally, accurate cost–benefit analysis identifies choices that increase welfare from a utilitarian perspective. Assuming an accurate CBA, changing the status quo by implementing the alternative with the lowest cost–benefit ratio can improve Pareto efficiency. An analyst using CBA should recognize that perfect evaluation of all present and future costs and benefits is difficult, and while CBA can offer a well-educated estimate of the best alternative, perfection in terms of economic efficiency and social welfare are not guaranteed.
The following is a list of steps that comprise a generic cost–benefit analysis.
- List alternative projects/programs.
- List stakeholders.
- Select measurement(s) and measure all cost/benefit elements.
- Predict outcome of cost and benefits over relevant time period.
- Convert all costs and benefits into a common currency.
- Apply discount rate.
- Calculate net present value of project options.
- Perform sensitivity analysis.
- Adopt recommended choice.
