CFOZone.com - The Network of Corporate Finance

We're building a new model / process for incorporating security related risk into financial forecasts. It's been driven off recent events and industry best practices (research reports) which suggest that there are many different security risks facing companies.

We're weighing two options -- 1) multiple forecasts which reflect different levels of security losses/incidents 2) an expected value approach.

We're leaning towards option 1 but some peers are suggesting having multiple forecasts is unmanageable.

Would appreciate any insights experiences anyone could share.

Can you tell us a bit more about what would be involved in each approach? Because while multiple forecasts would be more thorough, it could be unmanageable. But I'd like to hear more about your thinking.

We're weighing that right now and have advanced our thinking in the last 2 days.

The exercise seems to be more about having a baseline forecast which assumes things go well -- no major breaches or losses. But then building a contingency add-on "module" which incorporates financial impact both in terms of losses as well as forced expenses/investment triggered by the losses.

We're building a list of potential risk areas from a number of sources. One research report, I keep pointing people to is this one (a security survey) which is being offered for free by a application security company.
www.fortify.com/SSSIW_060510

Without a dedicated security function in the company, we're spending more time trying to capture the potential risk areas that could have a financial impact than actually assessing their forecast impact potential.

Long process.

This certainly does sound like a long process. How did it come about? Is there a champion in the company?

What are some of the risk factors you're addressing--What are some surprising ones, for example?

Do you think your conclusion could have an impact on any aspect of company operations?