Risk in plain numbers: probability times impact, the risk register, expected value
How to size a risk, list risks so someone acts on them, and decide which ones are worth paying to reduce. A worked example from a food factory in Malaysia.
Key takeaways
- Size a risk as the chance it happens times the damage if it does. That expected loss tells you which risks deserve money first.
- Common mistakes: Listing risks with no numbers, no owner and no action, which is a worry list, not a register.
- The international risk vocabulary (ISO Guide 73, as quoted by the US standards body NIST) defines risk as the "effect of uncertainty on objectives".
Key idea
Size a risk as the chance it happens times the damage if it does. That expected loss tells you which risks deserve money first. But a rare risk that could sink the company deserves protection even when the numbers say it is unlikely.
The international risk vocabulary (ISO Guide 73, as quoted by the US standards body NIST) defines risk as the "effect of uncertainty on objectives". In plain words: something might happen that pushes you off your plan. To compare risks, give each two numbers. Probability is the chance it happens in a year, such as 10 percent. Impact is the money lost if it happens. Multiply them and you get the expected loss: what the risk costs you each year on average. Expected value is the same idea for any uncertain outcome: add up each outcome times its chance.
A risk register is the list of risks with these numbers, plus the two things that make it useful: an owner (one named role responsible for each risk) and an action (what will be done to make it less likely or less damaging). Many companies also plot risks on a grid, with probability on one axis and impact on the other, so the dangerous corner is easy to see.
Worked case
Which risks should a food factory in Johor pay to reduce?
The prompt
A biscuit factory in Johor, Malaysia makes about MYR 15 million of profit a year. Its risk register is in the table with this case. Three actions are proposed: a second flour supplier (MYR 0.4 million a year extra), which would cut the impact of the main supplier failing from MYR 8 million to 2 million; a spare parts kit for the oven (MYR 0.15 million a year), which would halve the impact of a breakdown; and flood insurance (MYR 1.2 million a year), which would pay MYR 40 million of the MYR 50 million flood loss. Which should it take? (Fictional company, illustrative figures.)
The structure
- For each action: expected loss saved compared with what the action costs
- Expected loss = chance x impact, for every risk
- Action pays on average if the expected loss it removes is more than its cost
- Key: Survival test: could one event sink the company?
The exhibit
| Risk | Chance a year (percent) | Impact if it happens (MYR millions) | Expected loss a year (MYR millions) | Owner |
|---|---|---|---|---|
| Main flour supplier fails | 10 | 8 | 0.8 | Head of purchasing |
| Flood shuts the plant for months | 2 | 50 | 1 | Plant manager |
| Oven breakdown (the bottleneck) | 30 | 2 | 0.6 | Head of maintenance |
| Cyberattack stops ordering | 5 | 6 | 0.3 | Head of IT |
| Product recall | 3 | 20 | 0.6 | Head of quality |
Working it through
1. Total expected loss
Add the five expected losses.
Expected loss a year (MYR millions):0.1 × 8 + 0.02 × 50 + 0.3 × 2 + 0.05 × 6 + 0.03 × 20 = 3.32. Second supplier: loss removed
Expected loss falls from 10 percent x 8 to 10 percent x 2.
Expected loss removed (MYR millions):0.1 × 8 - 0.1 × 2 = 0.63. Second supplier: net
Minus its MYR 0.4 million a year.
Net gain a year, second supplier (MYR millions):0.1 × 8 - 0.1 × 2 - 0.4 = 0.24. Spare parts kit: net
Impact halves from 2 to 1, so the expected loss falls by 30 percent x 1; minus the kit's cost.
Net gain a year, spare parts (MYR millions):0.3 × 2 - 0.3 × 1 - 0.15 = 0.155. Insurance: expected payout
2 percent chance of a MYR 40 million payout.
Expected payout a year (MYR millions):0.02 × 40 = 0.86. Insurance: net
Expected payout minus the premium.
Net a year, insurance (MYR millions):0.02 × 40 - 1.2 = -0.47. Survival test
How many years of profit would a flood wipe out?
Flood loss in years of profit:50 ÷ 15 = 3.33
What the exhibit shows
The flood has the largest expected loss even though it is the least likely risk, because its impact is so large.
The recommendation
Take all three, for different reasons. The second supplier and the spare parts kit pay for themselves on average, gaining about MYR 0.2 million and 0.15 million a year, and the spare parts also protect the oven, which is the bottleneck. Flood insurance loses about MYR 0.4 million a year on average, as insurance almost always does, because insurers charge more than the expected payout to cover their costs and profit. Buy it anyway: a flood would wipe out more than three years of profit and could close the company. Expected value is the right guide for frequent, survivable risks; for rare, ruinous ones, protect survival first. Next, check whether flood barriers would cost less than the premium over time.
A building contractor in Riyadh, Saudi Arabia, expects a 70 percent chance a project finishes on time with a profit of SAR 10 million, and a 30 percent chance it finishes late with a profit of SAR 4 million. What is the expected profit, in SAR millions?
Listing risks with no numbers, no owner and no action, which is a worry list, not a register. Ranking risks by probability alone, so frequent small problems crowd out rare disasters. Treating expected value as the whole answer for risks that could end the company. Counting a risk twice under two names. Forgetting that risks can be linked: a flood can also cut off a supplier.
Risk A: 1 percent chance of losing 100. Risk B: 50 percent chance of losing 1. Which has the larger expected loss?
Why might a company buy insurance that costs more than its expected payout?
Which column turns a list of risks into a risk register someone can act on?
Insurers turn probability times impact into a business: they collect premiums, pay claims, and invest the money in between. The insurance brief shows how.
Read the insurance briefSources for this lesson (2)
- Recognized public explanations of case-interview concepts and terms
- NIST Computer Security Resource Center glossary, "risk": "effect of uncertainty on objectives", citing ISO Guide 73 (checked 2026-10-01)
My notes on this lesson
0 of 5,000 characters. Saves automatically.
Try the 4 remaining checks and drills above to complete this lesson (0 of 4 done).
Spotted something wrong or out of date? Report a mistake. We check every report and correct the page.