The risk exposure of a project or program is the additional cost that may be incurred, over and above the baseline budget, based on the identified risks as they are known at any particular time.
Risk exposure is calculated on the basis of weighted costs.
The weighted cost of an individual risk is the additional cost that the project or program would incur should the risk occur, multiplied by the probability that it will occur. For example, if the cost associated with a risk is $1,000,000 and there is a 10% probability of it occurring, the weighted cost would be $1,000,000 x 10% = $100,000.
The risk exposure of a project or program is the sum of the weighted costs of all the risks associated with that project or program.
Risk exposure is a statistical concept, based on the fact that any particular risk may or may not occur (if it is certain to occur then it is not a risk). The lower the probability of a risk, the less likely it is to occur. Simply adding up the expected cost of each risk, without taking its probability into account, will often give a significant overestimate of risk exposure.
Weighted Cost Limitations
Because of its statistical nature, the reliability of weighted cost as a predictor of risk exposure depends on the number of identified risks. If there are a fairly large number of such risks, say 40 or more, weighted cost can predict risk exposure quite accurately. However, the prediction accuracy drops off rapidly if there are less than about 10 identified risks.