Work out risk exposure value instantly with clear inputs, formula shown and shareable results.
Annualised risk exposure is probability multiplied by impact and expected frequency. Applying control effectiveness converts inherent exposure into residual exposure, and the difference is the value your controls deliver — which is what justifies their cost.
Inherent exposure
Inherent = Probability x Impact x Annual frequency
Residual exposure
Residual = Inherent x (1 - Control effectiveness %)
From testing evidence: how often the control operated as designed, and how much of the impact it would actually prevent. Self-assessed effectiveness is usually overstated.
Spend up to the reduction in exposure a control delivers, not the exposure itself. Beyond that the control costs more than the risk it removes.