Return on a Risk Fix — TechKnowSurge

About this interactive

Return on investment (ROI) is the lesson's favourite way to compare fixes: it turns any project into one percentage. For a risk fix: - reduction = inherent risk − residual risk (the risk before the fix minus the risk after) - benefit = reduction − cost of the fix - ROI = benefit ÷ cost, written as a percent The lesson's example: inherent $100,000, residual $10,000, cost $30,000. Reduction $90,000, benefit $60,000, ROI $60,000 ÷ $30,000 = 2, or 200%. In the ROI Worksheet demo, each risk is priced as probability × impact first. 33% × $400,000 = $132,000 inherent. After the fix, 9% × $150,000 = $13,500 residual. Reduction $118,500, less the $10,000 cost, is $108,500, and ROI is 1,085%. Why ROI and not the biggest saving: a fix that saves $100,000 but costs $90,000 returns about 11%, while one that saves $70,000 for $10,000 returns 600%. A fix that costs more than it saves has a negative ROI. Any ROI above 0% returns more than the fix cost; how high a return the business asks for is its own call, and the lesson notes estimates often overrun, which shrinks the real return. The video's quick example (save $3,000 for $300) is called 1,000%, which is the saving divided by the cost. With the lesson's own formula, which takes the cost out first, it is 900%.

What you'll learn

Calculate the return on investment of a risk fix: the reduction in risk (inherent minus residual), less the cost, divided by the cost, as a percent
Work out inherent and residual risk as probability times impact before calculating the return
Choose between fixes by return on investment rather than by the size of the risk reduction, and work the formula back to a missing cost or residual risk

Aligned to

ISC2 CISSP

1.9 Understand and apply risk management concepts

NIST CSF

ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated.

Key terms

Return on Investment: A measure of the financial return gained from an investment, calculated by dividing the net benefit by the cost of the investment, expressed as a percentage.
Inherent Risk: The level of risk that exists before any mitigation controls or countermeasures are applied. Understanding inherent risk helps organizations determine where to prioritize security investments.
Residual Risk: The level of risk that remains after security controls have been applied to reduce inherent risk. No control eliminates risk entirely; residual risk must be formally accepted by management or addressed with additional mitigations.
Risk Mitigation: The process of reducing the probability or potential impact of a risk through the implementation of controls, countermeasures, or process changes. Risk mitigation is one of four standard risk response strategies alongside avoidance, transfer, and acceptance.

Topics

Risk Management Risk Analysis Interactive Calculation

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →