Risk treatment is the only material category of enterprise spend whose authorising instrument contains no field for what it costs, so the decision to buy a control is made on gross benefit and never on net.
Every material category of enterprise spend has an instrument naming its price before the money moves. Capital has a business case. Procurement has a purchase order. Headcount has an establishment. A system change has a cost-benefit paper signed against a figure.
Risk treatment has a register, and the register has no column for money.
That is not one organisation's template but what the discipline's own instruments look like: the record carrying a risk forward through every review, audit and board pack holds the risk, the rating, the response, the owner and the date, and nothing about what the response costs.
So risk treatment is authorised on one side of a ledger. A control is approved because the exposure it addresses is large. Whether it is worth its price is a question the authorising instrument is not shaped to ask, and in most organisations nobody asks it elsewhere.
The Strategic Context
Look across six instruments in one body of risk teaching material — a register, an analysis worksheet, an evaluation worksheet, an action plan, a checklist and a procurement workbook — and money appears on three and not the other three.
The split is the finding. Cost appears on the sheets used once: the worksheet comparing candidate strategies at the moment of choosing, and the plan launching the one selected. It is absent from everything that persists. The register, called in the same material the single most important living document in the discipline, has no cost column. Nor does the standing checklist, whose worked entries prescribe lighting upgrades, bunding, audits and replacement protective equipment. The procurement workbook has a field for maximum probable loss and one for the type of insurance carried — a category, not a premium — and none for what a treatment costs, though its guidance says a reasonable-person test on control adequacy considers the cost of implementing controls, and it names failure to allow for whole-of-life costs a procurement risk.
Then the asymmetry closes. The doctrine requires the revised rating produced when strategies are compared to flow back into the register, and names failure to do so a defect. Nothing requires the cost to flow back, and nowhere provides a place for it to land.
Why the Cost Looks Like Somebody Else's Problem
Ask a risk function what its treatments cost and the answer is that they sit in operating budgets — true, and beside the point. A guarding upgrade is in maintenance capital, a testing regime in laboratory fees, two-worker attendance in rostered hours. Each is properly recorded in finance, and no ledger aggregates them under the heading of the thing they were bought for.
That is how an enterprise runs a large and growing treatment estate while believing it has good financial discipline. Each purchase passed a local approval on its merits; none was tested against the exposure it was meant to reduce, because the instrument recording the exposure and the instrument recording the money never meet.
The second effect is worse. With cost invisible, the only variable left to justify a treatment is the size of the threat. That biases every argument towards the largest number in the room — the worst case, undiscounted by probability — and funds the loudest risk regardless of what its treatment buys.
Reframing the Issue
A control is a purchased asset with an acquisition cost, a carrying cost, a service life and side effects. Nothing about it is unusual except that the enterprise has agreed not to write down its price.
The correct test is net: expected loss avoided less the cost of avoiding it, over a stated period. Expected loss avoided is exposure at the inherent rating minus exposure at the residual rating, both in money. If the rating scale cannot produce money it cannot produce a net, and that deserves stating on the paper rather than hiding inside a colour.
What happens instead is visible in the discipline's own worked answer. A treatment is justified by dividing a worst-case exposure by the cost of the response, and presenting the ratio as a return. The probability rating assigned two sections earlier plays no part; nor does the residual exposure that survives treatment; and a recurring annual premium sits in the same cell as a one-off cost and is added to it. Gross benefit over price, presented as a business case.
Where the Price Disappears
Priced once, then dropped
Evaluation of options is where cost is captured, and evaluation happens once. After selection the treatment moves onto the register as a response with an owner and a date, and the number is left behind. Every later review reads the register, sees no price, and is never prompted to ask for one.
Only the benefit is required to travel
The benefit is mandated to travel; the price is left on a worksheet in a folder. So the register always shows what the enterprise bought and never what it paid, and after a few years it reads, literally, as a list of improvements achieved at no cost.
The risk the treatment creates has no field
The doctrine is clear that responses generate secondary risks which must be identified, assessed and added to the register. Not one of the six instruments has a field for them. One text goes further, instructing that secondary risk be folded into the single post-treatment rating on the original row — which absorbs it rather than records it. Nothing marks a register entry as manufactured by a control, so no enterprise can total the risk its own control estate has created.
Decision Framework
The treatment cost line is a mandatory field on the risk register, completed before any treatment is approved and refreshed at every review. It has four parts. The one-off cost to establish, including implementation labour, and the budget it comes from. The annual cost to carry: consumables, testing, licences, maintenance, standby, a fraction of a role, and the throughput the control gives up. The review date and the budget holder in whose cost centre it sits — rarely the risk owner, and that mismatch is itself worth seeing. And the register references of any risk this treatment created; a blank means the analysis has not been done, not that the control is harmless.
Four rules make it bite. A treatment is authorised on expected loss avoided minus annual carry, never on gross exposure; where the scale cannot produce money, the paper must say the net was not calculable. A recurring cost is never set against a one-off exposure unless both are stated over the same horizon. The carry column is summed across the register each year and reported as the enterprise's risk treatment spend. And any treatment whose carry exceeds a set fraction of the loss it avoids goes to whichever authority approves capital of that size.
Three boundaries apply. A cost line shows the price of treating; it cannot tell you whether a risk left the register because it was treated or because the threshold moved, which belongs to [Related article: Treated, or Tolerated?]. Costing a control at purchase does not make anyone stop paying for it later, and the compounding estate of controls nothing retires belongs to [Related article: Who Retires a Control?]. And it makes your spending legible without telling you whether the framework producing those judgements is shared with everyone you compete with and everyone who audits you — the subject of [Related article: When an Industry Agrees on One Framework, It Goes Blind Together].
From Strategy to Execution
Immediate. Take the ten highest-rated risks and cost their treatments, one-off and annual. Expect difficulty, and record what could not be found; the gaps are the finding.
Medium term. Add the field to the register template, make it a mandatory gate on treatment approval, and require the budget holder to be named alongside the risk owner.
Long term. Publish an annual total for treatment carry alongside the residual risk profile, so the two move in front of the board together and can be argued against each other.
Signals to Monitor
Watch for treatments approved with no funding source named; for registers where residual ratings improve year on year while no cost changes; for insurance recorded by policy type without a premium; for controls whose budget holder cannot be named; and for a register that has never recorded a risk created by a response.
Questions for the Leadership Team
- What did we spend last year, in total, operating the controls named in our risk register?
- For our three most expensive controls, what expected loss does each avoid in money, and who worked it out?
- Which treatments were approved by comparing cost with the exposure they reduce, and which on exposure alone?
- Which cost centre carries each of our major controls, and does that budget holder know what the money is for?
- How many register entries exist because an earlier treatment created them, and how would we identify them?
- If our rating scale cannot convert a risk into money, on what basis did we approve the last material treatment we bought?
Closing Perspective
A commercial laundry serving healthcare accumulates controls as such operations do — barrier-wash validation, microbiological testing, a standby boiler, guarding on the calender line, effluent treatment. The register shows residual ratings falling. It does not show the testing fees, the standby energy, the planned downtime, or the confined-space hazard the boiler introduced. A community housing provider after a serious incident adds tenancy risk assessments, two-worker visits, an out-of-hours service and better door hardware; ratings fall again, cost disperses across four cost centres, and the halved visit rate that two-worker attendance produces is a risk to tenancy sustainment appearing nowhere. Both are hypothetical, neither unusual.
This is not a control failure but a control-of-controls failure, and it belongs to the executive rather than the risk function. A register without a price is not a governance instrument; it is a shopping list with the amounts removed. Whoever signs it approves spending they have chosen not to see, and will go on approving it until somebody adds the column.
About EraNorth Insights
EraNorth Insights publishes practical analysis on strategy, projects, operations, transformation and decision intelligence for professional and organisational use. About EraNorth.