Justifying a Resilience Project Against Risk Appetite

For a 72-hour outage, normal throughput loss is 3 days times $3.8 million, or $11.4 million. Manual fallback handles 35%, so lost throughput is 65% times $11.4 million, or $7.41 million. Activation takes 90 minutes, during which fallback is not available: 1.5/24 times $3.8 million equals about $237,500. Added labor is $18,000 per day times 3, or $54,000. Gross loss is therefore about $7.70 million. Insurance has a $500,000 retention and a $10 million limit, but recovery is uncertain and may not cover all categories, so the risk appetite test should use gross loss. The $4 million threshold is exceeded. Without the project, the assumed 12% annual likelihood is above the 5% appetite. With the project, 4% is below 5%, so the project meets the stated appetite. The expected-loss reduction is 8 percentage points times $7.70 million, or about $616,000 per year, giving a simple payback of roughly two years, before insurance and reputational effects. The project is justified primarily by appetite compliance, not by a quick payback.

The 12% and 4% figures are expert assumptions, not observed frequencies. With sparse historical data, the team should define the event precisely, document the basis, and use ranges rather than false precision. Sources could include phishing simulation results, control assessments, sector loss data, threat intelligence, and cloud-provider outage history. The most important sensitivity is the post-project likelihood: the project only meets appetite if it is at or below 5%. At 4%, the margin is thin; if the true value is 6% or 7%, the project alone does not satisfy the stated appetite and additional treatment or transfer is needed. The loss estimate is also sensitive to whether manual fallback actually reaches 35% and whether insurance pays promptly. Run a sensitivity table for likelihood at 8%, 12%, and 20% without the project and 3%, 5%, and 7% with it. If the project does not reliably bring the probability below 5%, the board should require extra controls or an explicit risk acceptance, not assume the model is precise.

Recommend conditional approval of the $1.2 million project because it addresses the dominant single-region dependency and brings the modeled likelihood below the 1-in-20 appetite. Conditions should include quarterly restore tests, an annual failover exercise, immutable backups with separation of duties, and validation that manual fallback can actually handle 35% of volume within 90 minutes. The residual risk remains material because a 72-hour outage would still exceed the $4 million threshold; the project reduces frequency, not severity. Therefore the board should also review insurance adequacy, confirm the $10 million limit and retention are acceptable, and set a trigger for revisiting the architecture if failover testing fails. Report the residual risk as a range, not a single number, and state the assumption that insurance recovery is uncertain. The CFO should avoid presenting the project as eliminating risk; it buys appetite compliance and shortens recovery, while residual severity is transferred or explicitly accepted.