Multiply the estimated impact of a risk by its probability to get an expected exposure figure, together with a clear warning about what expected values conceal on one-off decisions.
Risk registers are full of words like "high" and "amber" that cannot be added up or compared. Enter the financial impact if a risk materialises and the probability that it does, and the calculator returns the expected exposure in money.
Last reviewed 3 July 2026 · Free and ungated
Put the decision and its risk register to selected senior operators from the Global Board and receive confidential challenge on probabilities, impacts and blind spots.
Get independent perspectivesRisk exposure = estimated impact × probability %. How our tools work
Expected exposure is the standard way to make risks comparable: impact multiplied by probability. A €2,000,000 impact with a 10% probability is an expected exposure of €200,000, the same as a €400,000 impact at 50%. Once every risk on the register carries a money figure, mitigation spend can be judged against what it actually buys, and the loudest risk stops automatically being treated as the largest.
Expected value is honest across a portfolio and misleading on a single event. If the integration fails, you do not experience 10% of a €2,000,000 loss; you experience the full €2,000,000 or nothing. For one-off decisions the question expected value cannot answer is the one that matters most: can the organisation absorb the impact if the risk lands in full? A tolerable expected exposure attached to an intolerable impact is not a tolerable risk.
The best use of the figure is comparative and repeated: score the register the same way each quarter and watch what moves. It also disciplines mitigation proposals: spending €150,000 to mitigate a €200,000 expected exposure needs a better justification than the colour changing from red to amber.
Two inputs cannot describe a distribution. The calculator has no view on correlation, timing or velocity, and it inherits every bias in the impact and probability estimates. Treat the output as a comparison device and a challenge prompt, never as the risk's true size.
Use reference cases rather than introspection: how often have comparable programmes in comparable organisations hit this failure? Operators who have run similar programmes hold exactly this base-rate knowledge, which is why an outside view shifts these numbers more than another internal workshop.
As a rule of thumb for repeatable risks, yes. For risks whose full impact would be existential or irreversible, paying more than the expected exposure is rational: you are buying survival, not expected value.
Pick one convention and apply it to every risk on the register, or the comparisons are meaningless. Most teams use the credible worst case; if you do, resist the urge to soften it for risks attached to favoured projects.