Quantify in dollars
A color on a heat map does not survive a budget meeting. The Financial exposure section in a risk's workspace turns a scored risk into a dollar exposure — a range with an explainer, so the figure can be defended, not just presented.
Adding a quant profile
Qualitative assessment uses a 5×5 matrix after both severity and likelihood are recorded. A risk can remain unassessed, and financial modeling is optional. To quantify, change Quantification Method from Qualitative (5×5) to PERT/Triangular or Monte Carlo.
Both ask for three inputs in plain terms: how often a loss event might occur, how much a loss would cost, and how effective your mitigating controls are. You can enter each one yourself, click Auto-fill to populate them from the risk's qualitative scores, or let the platform derive them from what it already knows:
- Loss magnitude from the business services linked to the risk and their impact-analysis dollar figures. Use Apply to form under Derived from business services.
- Control effectiveness from the assurance of the risk's mapped controls. Derived from control assurance needs mapped controls.
- Loss event frequency from a base rate for the risk's category. Click Apply under Derive from threat base rates.
Dollar figures from business services need two things first. Link the services under Impacted Business Services in the risk's Assessment section. Then, under BIA > Services, give each service a Revenue Impact ($/hr), an Operational Cost ($/hr), and a Regulatory Penalty Risk ($). Until the linked services carry dollar figures, Apply to form does not appear.
What the dollar range means
SolveGRC estimates each open risk's annual loss on its own every 15 minutes, from the risk's scores, threat base rates, and any linked business services. So the financial section may show prefilled PERT inputs and a draft annual-loss preview before you run anything. Draft previews describe the current form; saved results describe the profile used by the recorded simulation. It skips a risk whose profile you entered by hand or that has Monte Carlo turned on.
To run the full simulation, click Save Quantification, turn on the Monte Carlo toggle, and click Run Simulation. The results are a range of annual loss outcomes rather than a single number:
- Expected Loss — the annual average across the simulated outcomes.
- Median Loss — the middle of the distribution of outcomes.
- VaR (90%) and VaR (95%) — modeled annual-loss percentiles. Under the saved inputs and simulation assumptions, 10% or 5% of modeled outcomes exceed the respective value. These are estimates, not guarantees about future years.
Two charts accompany the numbers: a loss exceedance curve (the chance of losing at least a given amount in a year) and a histogram of simulated outcomes. For related risks, a correlations panel lets you record that two risks tend to fire together, so the portfolio picture is not naively independent.
The explainer
The financial section keeps an input provenance panel next to the saved profile. For each input — loss event frequency, loss magnitude, control effectiveness — it records whether the value was an analyst entry, derived from BIA, derived from control assurance, or taken from a threat base rate, along with when it was captured. When a dollar figure is questioned, you can answer with its inputs, not a shrug.
Comparing against appetite
Dollar exposure earns its keep when it meets a limit. The module's header's Settings utility holds your risk appetite: dollar thresholds for acceptable, elevated, and critical annualized exposure, portfolio-level limits, and your cyber insurance details (carrier, limit, deductible, renewal date).
The Insights > Portfolio view reads the register against that appetite: a gauge of portfolio exposure, an exposure trend over time, and a breach alert listing any risks that exceed the configured limits, each linking back to the offending register entry. The same view exports as a board packet.
That closes the loop: a risk raised or promoted, treated, and priced. To see where the register's vendor inputs come from, continue to TPRM: Assess risk.