How do you quantify risk?

There are a number of ways to quantify risk. Here are two approaches to help quantify risk.

Say your company produces widgets and has two machines in the manufacturing process. Machine A is worth $100,000 and would take months to replace if it was damaged. Machine B is worth $20,000 and can be replaced quickly. In order to protect this asset you probably have insurance and some type of maintenance is performed on the machine on a regular basis to keep it from breaking down.

Let’s say that the annual costs of  maintenance is $10,000 for Machine A and $1,000 for Machine B. Machine A breaks down one per quarter and Machine B breaks down twice a year. Each time a machine breaks down it cost your company revenue which has an impact on your profitability and your reputation.  

    

Approach 1 is the Weighted Factor Analysis:

Simply calculate the risk factor by multiplying the results in each category to determine which machine present the most risk for the organization.

Asset	Revenue Impact	Profitability Impact	Reputation Impact	Weighted Score
Weight Factor 1-100	30	40	30
Machine A	.8	.9	.5	75
Machine B	.8	.9	.6	78

Based upon the weighted score Machine B has more value and more risk for the organization.

Approach 2: Annualized Loss Expectancy

Each machine has as exposure factor (EF) that it is going to fail. Let say that Machine A is .1 and Machine B is .2. This means that the for each loss the Single Loss Expectancy (is cost of each down time) can be calculated as follows: SLE = Asset value * EF

Machine A’s  SLE = $100,000 * .1 = $10,000

Machine B’s SLE = $20,000 *.2 = $4,000

We already know that Machine A breaks down one per quarter and Machine B breaks down twice a year. 

So the Annualized loss expectancy (ALE) for each machine is:

Machine A’s ALE = $10,000 * 4 = $40,000

Machine B’s ALE = $4,000 * 2 = $8,000

Machine A is clearly the most valuable machine in the organization and causes the most loss from breakdowns each year. From this information it is probably worth exploring a risk mitigation alternative for Machine A such as: more frequent maintenance, spare parts on hand, or training on maintenance prevention to reduce the expense of downtime. In the first approach Machine B is more at risk but taking a further look at approach 2 indicates that the Annualized Loss Expectancy for Machine A is really more costly for the organization.