BOKRIM Thinking

Risk managers need to know how much to spend on risk management

What an organization spends on sexual abuse and misconduct (SAM) risk management has nothing to do with how safe they want minors and vulnerable adults to be.  Every organization wants minors and vulnerable adults to be safe.   

Knowing what to spend on managing any risk is important because whatever an organization spends on risk management is money it cannot spend elsewhere.  Yet, not spending enough may leave the organization exposed, and potentially very exposed, to loss it cannot fund.

So, what an organization spends on SAM risk management depends on what it wants its total cost of SAM risk to be.  The total cost of an organization’s risk is the combination of:

  • Budgeted costs: for regular activities involved in managing risk, which are spent during a given period (usually a year) even if the risk doesn’t crystalize;
  • Un-budgeted costs: the potential annualized costs of the unexpectedly frequent or severe crystallization of the risk; and
  • Intangible costs: the potential annualized reputation costs or the costs of an organization failing to meet its core objectives because of risk. 

Annualized costs are the potential total loss that could realistically be incurred if a risk crystalized, multiplied by the likelihood an event giving rise to a loss will occur in the next year.  Budgeted costs reduce either the likelihood the risk will crystalize or the potential consequences or both.  

For risks like SAM risk which cannot be eliminated, the total cost of an organization’s risk is optimized when the activities that are budgeted for are just enough to be as effective as reasonably possible at minimizing the unexpected and intangible costs.  The right ratio is important because it ensures an organization can allocate its annual budget reasonably across all its risks and all the other competing demands for funding.

BOKRIM delivers the tools to investigate this ratio for an organization’s SAM risk.

Knowing what to spend on risk management is a BOKRIM core objective.

Like this article?

Leave a comment