A board weighs what control costs against what failure costs. The cost of action is known and budgeted. The cost of inaction is uncertain and can be many times larger, and some of it can't be bought back.
| Cost of action | Cost of inaction | |
|---|---|---|
| People | Training, supervision, time on checks | Illness, hospitalisation, possibly death |
| Licence to operate | Registration, licence conditions, audits | Improvement notices, closure, suspension or loss of licence |
| Regulatory | Compliance records, | Penalty notices, prosecution, published offence registers |
| Reputation | Honest reporting, a practised crisis plan | Lost trust, public coverage that stays searchable |
| Commercial | , testing, supplier approval | Lost contracts, delisting, customer claims, lower sales |
| Financial | A planned programme budget | , disposal, investigation, legal costs, higher insurance |
| Leadership | Regular board time | Personal exposure, time consumed by the crisis |
Test it with your own numbers
These starting values are made up. Put in your own programme cost, your estimate of a serious incident's total cost, and the yearly chance you'd assign to one.
The comparison
| Programme cost each year | 150,000 |
|---|---|
| Expected yearly loss without it | 250,000 |
| Chance at which they're equal | 3.0% a year |
On these figures alone, the programme pays for itself.
A programme is required by law in many cases, so this isn't a choice between having one and not. It helps a board judge how much to invest beyond the minimum.
Some of these costs can't be bought back afterwards. Treat the calculator as a way to frame the conversation, because the worst outcomes aren't only financial.