Quantify in dollars
A color on a heat map does not survive a budget meeting. The Quantification tab in a risk's detail drawer turns a scored risk into a dollar exposure — a range with an explainer, so the figure can be defended, not just presented.
Adding a quant profile
Every risk starts on the qualitative 5×5 matrix from its severity and likelihood scores. To quantify, pick a higher tier in the tab: a dollar-estimate tier, or the full Monte Carlo simulation tier.
Both ask for three inputs in plain terms: how often a loss event might occur, how much a loss would cost, and how effective your mitigating controls are. You can enter each one yourself, auto-populate them from the risk's qualitative scores, or let the platform derive them from what it already knows:
- Loss magnitude from the business services linked to the risk and their impact-analysis dollar figures.
- Control effectiveness from the assurance of the risk's mapped controls.
- Loss event frequency from a base rate for the risk's category.
What the dollar range means
With a profile saved, running the simulation produces a range of annual loss outcomes rather than a single number:
- Expected loss — the annual average across the simulated outcomes.
- Median loss — the middle of the distribution of outcomes.
- Worst-case figures at 90% and 95% confidence — the losses you would only expect to exceed one year in ten, or one in twenty.
Two charts accompany the numbers: a loss exceedance curve (the chance of losing at least a given amount in a year) and a histogram of simulated outcomes. For related risks, a correlations panel lets you record that two risks tend to fire together, so the portfolio picture is not naively independent.
The explainer
The tab keeps an input provenance panel next to the saved profile. For each input — loss event frequency, loss magnitude, control effectiveness — it records whether the value was an analyst entry, derived from BIA, derived from control assurance, or taken from a threat base rate, along with when it was captured. When a dollar figure is questioned, you can answer with its inputs, not a shrug.
Comparing against appetite
Dollar exposure earns its keep when it meets a limit. The module's Settings tab holds your risk appetite: dollar thresholds for acceptable, elevated, and critical annualized exposure, portfolio-level limits, and your cyber insurance details (carrier, limit, deductible, renewal date).
The Executive tab reads the register against that appetite: a gauge of portfolio exposure, an exposure trend over time, and a breach alert listing any risks that exceed the configured limits, each linking back to the offending register entry. The same view exports as a board packet.
That closes the loop: a risk raised or promoted, treated, and priced. To see where the register's vendor inputs come from, continue to TPRM: Assess risk.