Is a risk mitigation worth its cost? Compare the residual risk too

The short answer

Compare the original expected risk cost with the cost of the action plus the expected residual risk. The action is not free, and the risk usually does not disappear. Keep all three amounts in the same comparison.

Work through one named event

Suppose an illustrative vendor-integration event has a 30% probability and would cost 12,000 if it happens. Its expected monetary cost is 0.30 × 12,000 = 3,600. An upfront validation costs 1,500. You assess that it would reduce the event probability to 10% and the severity to 8,000.

Expected residual cost is 0.10 × 8,000 = 800. Action plus residual expectation is 1,500 + 800 = 2,300. Net expected benefit is 3,600 − 2,300 = 1,300. The break-even action cost is 3,600 − 800 = 2,800.

Challenge the assumed effectiveness

The arithmetic is easy; the claimed reduction needs evidence. If the action only reduces probability to 20% and leaves the 12,000 impact unchanged, expected residual cost is 2,400. With the same 1,500 action cost, total expected cost becomes 3,900 and net expected benefit becomes −300.

Use the mitigation-value calculator to keep the optimistic action case as a baseline and compare the weaker effect. Record why the action changes probability or severity, who owns it and what completion evidence the bid review requires.

An average does not describe the event branch

In the original simplified model, the event costs either zero or 12,000. It does not cost 3,600 on each project. After the action, total incremental cost is either 1,500 or 9,500. A favorable expected value does not guarantee a saving on one job.

For the same reason, expected value is not a P80 funding or cost reserve. A discrete event introduces jumps in the outcome distribution. Read contingency without double-counting before turning expected risk costs into fixed allowances. The contingency calculator is a separate normal approximation for one total-cost range, not an exact model of this binary event.

A monetary comparison can leave out the deciding factor

This model contains one event, one severity in each state and a certain action cost. It does not measure reputation, safety, contractual exposure, correlated events or the value of learning. A small expected loss can still be unacceptable because of the event branch. Record those considerations separately instead of inventing a probability to make the spreadsheet choose the desired answer.

Keep the mitigation tied to the quoted plan

If the quote assumes the action is completed, include its cost and owner in the estimate. If it is later removed, revisit the residual risk rather than silently keeping the reduced probability. The bid-review checklist provides a place to record that condition. The GAO cost guide is a broader reference for documenting estimating assumptions and risk analysis; the monetary examples here are original illustrative calculations.

Prepared with AI assistance. These are illustrative calculations checked against the calculator code, not client case studies or market benchmarks.