Until now, data gathered in the process has been used to develop the framework in which specific risks, incidents, events and values are to be set. Once that is done, we can begin quantifying risk values within the methodology.
The table below converts the severity factors into a single average necessary for the calculation.
- Tally: The number of individual risk items that fell within each threshold designation.
- Numerical Factor: The midpoint of the ranges used for each threshold designation. For instance, if you establish a range of $10 million to $30 million for “high,” $20 million should be used.
- Subtotal: For each threshold designation, this is the result of multiplying the tally and numerical factor.
- Average Estimated Gross Severity (Loss): Calculated by adding the subtotals ($99,500,000 in the example) and diving by the tally total (17, representing all individual risk items across all threshold designations).
Designation* Tally Numerical Factor** Subtotals Low 8.5 $500.000 $4,250,000 Medium 3 $3,000,000 $9,000,000 High 3.5 $7,500,000 $26,250,000 Catastrophic 2 $30,000,000 $60,000,000 Average Estimated Gross Severity (Loss): $5,853,000. Comparing this number to the severity thresholds, this ranks as High.
We follow a somewhat similar process for frequency.
- Tally: The number of individual risk items that fell within each frequency factor.
- Numerical Factor: The midpoint of the ranges used for each frequency factor. For instance, if you establish a range of 11%–30% for “unlikely,” 20.5% should be used.
- Tally-weighted Probability: Multiply the tally by the numerical factor.
- Average Estimated Probability: Total up the tally-weighted probabilities (in this example, that is 671.5%). Calculate the average by dividing that number by the tally (671.5%/17 = 39.5%).
Designation Tally Numerical Factor*** Tally-weighted Probability Rare 0 N/A N/A Unlikely 8 20.5% 164 Likely 8 52.5% 420 Very Likely 1 87.5% 87.5 Average Estimated Probability: 39.5%. Comparing this number to the frequency factors, this ranks as Likely.
Putting these together, the probability-weighted gross loss is $2,311,935
($5,853,000 x 39.5%).
Again, a unique aspect of this Methodology is that numbers used in developing the framework and values originate from established company risk benchmarks and empirical observations and data. Many risk assessment approaches rely heavily on judgment and assumptions rather than data.
* This example shows where a company does not use a “Negligible” threshold — “Low” is the lowest.
** These are example mid-points of the range of severity thresholds as discussed above.
*** These are example mid-points of the range of each frequency threshold as discussed above.