Lakeshore Outfitters: Six Loss Forms Without Double Counting
Lakeshore Outfitters, annual revenue $180M, completed a 14-month POS malware investigation covering 2.3 million payment cards. Finance and legal assembled the final cost schedule: external forensics $1.4M; internal IT overtime $600k; CEO and CFO time $250k; replacement of 1,800 terminals $900k; customer notification, call centre and mailing $700k; 24 months of credit monitoring $2.4M; card-brand fines and assessments $2.1M; plaintiff legal defence $1.1M; state attorney-general settlement $500k; and a 4.1% decline in online sales across two quarters, amounting to $3.7M of lost gross margin. The risk register entry drafted by the analyst lists 'loss magnitude $13.65M', cites the credit monitoring as both a response cost and a reputation cost, and folds CEO and CFO time into the internal overtime line. The CFO asks whether the $3.7M belongs in the risk analysis at all, since sales came back afterwards.
1. Classify every line into the six FAIR loss forms, mark each as primary or secondary, and identify the classification errors in the draft register. Produce corrected primary and secondary subtotals.
Read the worked answer
| Line | Form | Primary or secondary |
|---|---|---|
| External forensics $1.4M | Response | Primary |
| Internal IT overtime $600k | Productivity | Primary |
| CEO and CFO time $250k | Productivity | Primary, counted separately |
| 1,800 terminals $900k | Replacement | Primary |
| Notification, call centre, mailing $700k | Response | Primary |
| Credit monitoring $2.4M | Response | Primary |
| Card-brand fines and assessments $2.1M | Fines and judgments | Secondary |
| Plaintiff legal defence $1.1M | Fines and judgments | Secondary |
| Attorney-general settlement $500k | Fines and judgments | Secondary |
| Lost gross margin $3.7M | Competitive advantage | Secondary |
Primary subtotal: 1.4 + 0.6 + 0.25 + 0.9 + 0.7 + 2.4 = $6.25M. Secondary subtotal: 2.1 + 1.1 + 0.5 + 3.7 = $7.4M. Total: $13.65M, which matches the draft arithmetic.
The errors are in the labelling, not the sum. Credit monitoring is assigned to two forms; if it is also carried in a reputation line the exposure is overstated by $2.4M, taking the register to $16.05M. CEO and CFO time is folded into internal overtime, so the $250k is either inside the $600k or additional, but it cannot be both. Legal defence could defensibly sit in response or in fines and judgments; what matters is choosing one convention and applying it across every scenario so the results remain comparable. Rule: one dollar, one form.
2. Does the $3.7M sales decline belong in the analysis, given that sales recovered? Explain how to treat the rebound and how to handle reputation without double counting it.
Read the worked answer
Yes, if the analysis period covers the two quarters in which sales fell. Lost gross margin is a real cash effect on the firm and it is properly measured as margin rather than revenue, because the variable costs that were not incurred offset part of the revenue loss. The analyst has that part right.
The rebound affects two things and neither removes the loss:
- The loss horizon. The effect is a two-quarter effect, not a permanent one, so it is modelled over that window. If a residual share of customers never returned, the effect extends beyond the window and should be modelled as a decaying stream, not a flat one.
- Whether reputation is a separate line. In FAIR, reputation is a distinct loss form only when it produces a measurable effect not already captured elsewhere: higher customer acquisition cost, a higher cost of capital, increased insurance premiums, or sustained churn. If you count the sales decline as competitive advantage and then add a reputation figure derived from the same decline, you have counted one effect twice.
So: keep the $3.7M, document it as competitive advantage with an explicit two-quarter horizon, and state that no separate reputation line is included because no distinct mechanism was measured. If the CFO wants reputation represented, ask for the specific cash mechanism and estimate that instead.
3. The CFO wants to add a 15% reputation multiplier to the total because breaches always cost more than expected. Evaluate this proposal.
Read the worked answer
Reject it, but address the legitimate concern behind it.
Why a blanket multiplier fails:
- No mechanism. A multiplier does not identify what is being estimated, so it cannot be defended, calibrated, or improved. Nobody can say what evidence would move it to 10% or 20%.
- Scale confusion. A 15% uplift on a $50k scenario and on a $50M scenario assume the same relative behaviour, which is implausible; secondary losses do not scale linearly with primary ones.
- Breaks comparability and sensitivity. Results can no longer be compared with other scenarios analysed without the multiplier, and management cannot see which factor to fix to reduce the number.
- Mixes drivers. It is applied to a total that blends primary and secondary losses with entirely different drivers.
The concern is real and should be decomposed. If repeat breaches draw larger card-brand assessments, estimate the escalation explicitly. If churn was underestimated, widen the churn range with a calibrated estimate. If litigation costs are open-ended, model legal defence as a distribution with a fat tail rather than a single figure. Each becomes its own line with its own 90% confidence interval. If the total still looks low afterwards, the answer is better inputs, not a percentage applied to the answer.