Return to site

Estimating the Financial Cost of an Incident

How do you calculate impact?

· Security Management,Risk Management,Impact Assessment,Financial Impact,Richard Schneller

It is critical to know the financial impact of an incident. There can be much discussion about how this should be measured, but the key is to make sure that the measurements are standardized. Set business rules for the estimation in such a way that the impact of one incident can be compared to another in a consistent way. Bear in mind that the estimate is just that, consistency is far more important than accuracy. For instance, in a retail environment an item selling in one store, in one country, may have a very different price when compared to that same item in another store in another country. Many factors will come into play, such as distribution costs, buying power, marketing and promotion strategies, exchange rates, differing mark-ups and so on. In some industries the cost of a lost item may be only a small part of the overall impact cost. If the item is critical to a project and the project is delayed, then the item cost may be small, but the actual impact cost could be huge because of the costs of project delays.

The person who witnessed or reported the incident is often not best placed to do this kind of estimation. It may be better to leave it to professional experts to review the incident and make the assessments in a consistent way. One can think of the cost as being made up of a ledger of cost accounts, including categories for loss such as cash missing, cost of assets lost, cost of property lost or damaged, and other loss categories. On the positive side of the ledger are cost of goods (fully or partially) recovered, cash recovered, property returned or mended, and insurance. It is likely the structure of this ledger will vary from one company/industry to another with some categories having greater importance.

In health and safety there can be many related factors to consider, for instance, people affected, hours lost and sometimes, more importantly, key people affected. Of course, currently the pandemic raises all these issues as potential critical threats to the organization, perhaps even to its ongoing viability. We have become used to the outputs of pandemic modelling at a country or region level, but it seems suddenly that human resources and business continuity specialists need to come together to evaluate and predict the effect on the organization and develop measures to mitigate the impact. Overall facilitating the collaboration of experts is likely to get optimal results.

One concept that often confuses, is how to handle recoveries. An item is stolen but it is covered by insurance and some percentage is recovered, so what is the loss? It is better to think in terms of total loss using the formula total-loss - recovery = net-loss. In reporting, make sure the audience knows what they are working with - total-loss or net-loss. For consistency and comparisons total-loss is usually the better measure. Recoveries can be looked at separately and compared to the total loss.

Exchange rates are, of course, another potential source of inconsistency. Companies normally operate in one base currency and, for comparison, everything should be converted to that currency. But this means that exchange rate fluctuations must be considered. It is better that users reporting incidents report in the currency in which the item is priced or costed. Sometimes such fluctuations can be dramatic. For instance in 2020 the Venezuelan Bolivar lost 70% of its value against the USD and recently the Lebanese Pound which historically was pegged to the USD is now un-pegged and in free fall. The local currency can be converted to the corporate standard using an exchange rate. But this means maintaining up-to-date exchange rates for all the currencies that may occur. In our experience a manual maintenance of rates is not effective. Instead TeamMacro TERSM now uses a direct bank connection to get real-time rates.