How do you conduct a cost-benefit analysis for risk mitigation?

• A. Compare expected costs of mitigation with expected reduction in risk costs, often using net present value.
• B. Only count the benefits.
• C. Ignore costs and focus on compliance.
• D. Use qualitative judgment only.

Answer: (A)

In risk mitigation, the main idea is to translate both the costs of implementing controls and the expected costs of the risk into monetary terms and compare them. This is typically done using net present value to account for the timing of costs and benefits, so future savings are brought to a present value for a fair comparison. The goal is to determine whether the reduction in expected risk costs justifies the investment over the planning horizon.

This approach is best because it provides a clear, objective metric to judge whether a mitigation move adds value, taking into account both what you spend now and the money you avoid losing later. If you only count benefits, you ignore the costs and overstate value. If you ignore costs and focus on compliance, you can't assess whether the effort and expense actually pays off. If you rely solely on qualitative judgment, you lose a consistent, comparable basis for decision-making.