Calculator Inputs
Use your incident history and operating conditions to estimate expected loss and a practical capital buffer. Adjust scenarios to compare outcomes.
Example Data Table
These sample values illustrate typical inputs and resulting outputs. Replace them with your own data for a realistic assessment.
| Scenario | Incidents/Yr | Avg Loss | Control Eff. | MTTD+MTTR | Adjusted EL | Capital Guidance | Risk Level |
|---|---|---|---|---|---|---|---|
| Payments Processing | 6 | USD 25,000 | 70% | 32 hrs | USD 177,000 | USD 239,000 | Moderate |
| Customer Onboarding | 10 | USD 18,500 | 55% | 60 hrs | USD 290,000 | USD 410,000 | High |
| Vendor Management | 3 | USD 40,000 | 75% | 20 hrs | USD 120,000 | USD 165,000 | Low |
Formula Used
This calculator uses a transparent, practical model inspired by common operational risk components: frequency, severity, controls, environment, and resilience.
How to Use This Calculator
- Enter incident history using incidents per year and average loss. If you have sparse history, start with conservative estimates and update quarterly.
- Set control effectiveness based on test results, audit outcomes, and control coverage. Avoid using 100%; the model caps impact by design.
- Tune environment inputs such as turnover, automation, third-party dependency, and regulatory change to reflect current operating conditions.
- Add resilience metrics (detection and recovery) and governance ratings (data quality and continuity maturity) to reflect how fast you contain losses.
- Choose confidence and tail multiplier to align with your risk appetite and the heaviness of tail events in your business line.
- Compare scenarios by changing one driver at a time. Use the CSV/PDF exports to document assumptions and discuss mitigation priorities.
Quantify frequency and severity from loss history
Start with incidents per year and average loss per incident. The calculator multiplies them to form Baseline Expected Loss, an annual gross view of exposure. Add a maximum single loss to reflect rare shocks. Use the time horizon to scale the annual view to 1–120 months so quarterly and annual plans stay aligned. Track events above your reporting threshold to keep frequency stable over time.
Translate controls into measurable reduction
Controls reduce losses, but the model avoids “zero risk” outputs. Control effectiveness is applied with a 60% reduction cap, so strong coverage still leaves residual risk. Pair the percentage with a testing frequency (monthly through annual) to keep assumptions disciplined. When exceptions rise, lower effectiveness and re-run scenarios. Better controls also lower the score’s control component.
Capture environmental pressure and third‑party exposure
Risk rises with change. Staff turnover increases the environment factor, and third‑party dependency (0–100) captures vendor and outsourcing exposure. Regulatory change level (1–5) adds pressure when requirements shift. Automation level (0–100) rewards repeatable processing; low automation increases the penalty. Use scenario names to compare products, regions, or platforms side by side. If transaction volume is available, sanity-check incident rates per million transactions and spot outliers across business lines quickly.
Model resilience using detection and recovery times
Resilience uses mean time to detect and mean time to recover. Longer combined hours lift a time factor, reflecting extended disruption and remediation. Governance ratings add friction: data quality (1–5) and continuity maturity (1–5) increase loss when ratings are low. Improve monitoring, runbooks, and failover to reduce impact and tail risk. Shorter recovery often reduces customer compensation costs too.
Convert results into governance actions
Outputs include adjusted expected loss, stressed expected loss, a tail add‑on, and capital guidance. Confidence options of 90%, 95%, and 99% increase tail conservatism, while tail multiplier (1–5) represents heavier tails in technology, fraud, or conduct events. Net after insurance shows coverage impact. A 0–100 score maps to Low, Moderate, High, or Critical and identifies the top driver. Export CSV or PDF to document assumptions for committees.
FAQs
What does Adjusted Expected Loss represent?
It is the baseline incident loss estimate, reduced by control effectiveness and then scaled by environment and resilience factors for your chosen horizon. It is a practical expectation, not a worst case.
How should I set control effectiveness?
Base it on control design, coverage, and recent testing results. If key controls are manual, inconsistent, or have many exceptions, use a lower value. The model caps benefit to keep residual risk.
What is the difference between stressed loss and tail add-on?
Stressed loss uses a higher severity assumption influenced by confidence level, tail multiplier, and maximum single loss. The tail add-on is an extra buffer added to adjusted loss to approximate capital for extreme events.
Why do MTTD and MTTR change the outcome?
Longer detection and recovery extend disruption, increase remediation effort, and raise the resilience factor. Improving monitoring, alerting, and recovery procedures typically reduces both adjusted loss and tail sensitivity.
How does insurance coverage affect capital guidance?
Insurance is applied as a simple reduction to show a net view after coverage, never below zero. Use it to compare scenarios, but validate policy limits, deductibles, exclusions, and claim certainty separately.
How can I use the score and driver indicator?
Use the 0–100 score to standardize discussion across processes and to track improvement. The highlighted driver points to the biggest contributor, helping you prioritize controls, vendor actions, staffing, or resilience investments.