Pharmaceutical Warehouse Risk Ranking and Countermeasure Payback
A pharmaceutical distributor operates a 180,000-square-foot warehouse holding $2.4 million of high-value active pharmaceutical ingredient (API) in a caged vault, $900,000 of temperature-sensitive product in cold rooms, and $180,000 of replaceable copper piping in the mechanical yard. The risk register lists three scenarios: copper theft with annual probability 0.40 and total replacement loss; API pilferage with probability 0.15 and an assumed 30% loss of inventory; and cold-chain spoilage from a power outage with probability 0.08 and 40% loss. Insurance covers theft after a $25,000 deductible and excludes spoilage caused by utility failure. A proposed $120,000/year package adds one guard, yard analytics, and vault access logging; the vendor claims it will cut copper theft probability to 0.15 and API pilferage to 0.05. The CFO wants a payback calculation. The quality unit is separately concerned about data integrity and regulatory reporting for any API loss.
1. Calculate the annualized loss expectancy for each scenario and rank them. Show your work.
Read the worked answer
Copper theft: single loss is $180,000, probability 0.40, so ALE = 0.40 × $180,000 = $72,000. API pilferage: loss is 30% of $2.4 million = $720,000; ALE = 0.15 × $720,000 = $108,000. Cold-chain spoilage: loss is 40% of $900,000 = $360,000; ALE = 0.08 × $360,000 = $28,800. Total ALE is $208,800 before insurance effects.
Ranking by ALE alone puts API pilferage first, copper theft second, and spoilage third. That ranking is useful but incomplete. The API scenario has the highest single-loss severity and regulatory consequences; copper theft is the most frequent event; spoilage is the least frequent but may be uninsurable here. The calculation also assumes independent scenarios and single-point probabilities, so present it as an order-of-magnitude estimate. The $25,000 deductible applies per theft claim and should be added to the expected cost of the theft scenarios, but it does not change the ranking.
2. Evaluate the $120,000/year package on a purely financial basis and state your recommendation.
Read the worked answer
With the vendor's claimed reductions, copper ALE becomes 0.15 × $180,000 = $27,000, a reduction of $45,000. API ALE becomes 0.05 × $720,000 = $36,000, a reduction of $72,000. Spoilage remains $28,800 because the package does not address power. Residual total ALE is $91,800, so the package avoids $117,000 per year against a $120,000 cost-a net cost of about $3,000 per year, or a negative return before insurance effects. Including reduced deductible exposure could narrow the gap, but it does not make a strong financial case on these assumptions.
Recommendation: do not buy the full package as proposed. Ask for a targeted vault and API-handling package-access logging, two-person integrity, analytics, and audit-at a lower cost, and model a copper-only option separately. Treat the vendor's probability reductions as unverified and run a sensitivity case where the reductions are half as large; the net benefit disappears quickly. The full package may still be justified for regulatory or safety reasons, but the CFO should see that it is a risk-control purchase, not a positive-return investment.
3. What non-financial factors could change the decision, and how would you present the residual risk to the CFO?
Read the worked answer
API loss is not just inventory loss. It triggers regulatory reporting, quality investigations, possible licence exposure, customer audits, and reputational damage. Cold-chain spoilage has product-release and patient-safety implications, and the insurance exclusion means the site retains that risk. Copper theft also creates operational downtime and safety hazards in the mechanical yard. These factors can justify spending above the purely financial break-even point, but they should be stated explicitly rather than buried in the ALE.
Present a simple table: scenario, ALE, residual ALE with the control, cost, net financial effect, and non-financial driver. Add a sensitivity range for probability and loss, and state what is not modelled-regulatory fines, lost sales, and investigation cost. Recommend a decision rule: fund controls that reduce severe, uninsurable, or compliance-critical risk even when payback is neutral; defer controls that only address low-consequence, insured risk. If the CFO rejects the full package, document the accepted residual risk and assign an owner and review date.