From Risk Visibility to Risk-Adjusted Business Decisions

What if risk could be measured as continuously as revenue — and reflected in the economics of every product and service?

Most operational risk frameworks tell you what already went wrong. Incidents are logged, losses are recorded, key risk indicators are reviewed on a cycle, scenarios are refreshed periodically, and the board receives an aggregated picture some weeks after the period it describes. All of this is necessary. Very little of it is current.

The alternative is not to discard those frameworks. It is to add a second view: risk measured close to where it is actually created — by product, by service, by transaction volume and by the operational environment that carries it — and refreshed often enough to inform decisions while those decisions are still open.

That is the premise of Risk Accounting, a methodology developed and published by the Risk Accounting Standards Board. VODIS works on the implementation side: translating the method into an operating model, sourcing the data, building the management view, and — as a distinct step that belongs to VODIS, not to the standard — exploring what measured risk implies for a productx27s economics.

Why a Retrospective View Is Not Enough

A quarterly risk report answers "what happened?" well. It answers "what is accumulating right now, and in which product?" poorly, and barely answers "what would this decision do to our risk?" at all.

The practical consequences are familiar to most risk and finance functions:

  • Growth is approved before anyone has established whether controls scale with it.
  • Two products are compared on margin, with no comparable measure of the risk each one carries.
  • Control weaknesses are known in the first line long before they appear in a committee pack.
  • Remediation is prioritised by audit finding or by whoever argues hardest, rather than by exposure.
  • Outsourcing decisions are taken on cost, with the risk consequence described only qualitatively.

Measuring Risk Where It Is Created

The shift is from measuring risk after it materialises to measuring the exposure an activity carries while it is under way. Three things drive that exposure: what the product or service structurally is, how much of it is being done, and how well the control environment around it actually works.

Expressed that way, risk can be compared across a portfolio rather than described separately for each part.

Risk Accounting and the Risk Unit

Risk Accounting is developed and published by the Risk Accounting Standards Board (RASB), which describes itself as an independent, academic and practitioner-led standard setter established under Durham University Business School. The definitions below are RASB's own.

The method expresses non-financial risk in a common denomination so that different exposures can be added together and compared:

  • Risk Unit (RU) — RASB's standard measure, which represents non-financial exposure in a common measurement denomination.
  • Inherent Risk — gross exposure before controls and mitigation are taken into account.
  • Exposure Uncertainty Factor (EUF) — represents the structural risk characteristics and uncertainty associated with the defined activity, product, service or process, reflecting matters such as complexity, operational dependencies and the stability of the environment.
  • Value-Based Weighting — observable throughput or transaction scale informs the relative weight of the unit. RASB is explicit that this does not assert mechanical, proportional or predictive causation on ultimate losses.
  • Risk Mitigation Index (RMI) — an empirical, dynamic and auditable index of control effectiveness, expressed as 0–100%.
  • Residual Risk — the remaining net exposure after mitigation, also represented in Risk Units.

The published logic runs in that order: structural exposure, combined with business activity and its weighting, produces inherent risk expressed in Risk Units; applying the control-effectiveness index produces residual risk in the same unit.

Two points of accuracy matter here, and VODIS states them plainly. RASB publishes the structure of the method but not its detailed scales and formulations, so this page does not reproduce numbers it cannot source. And RASB is explicit that measurement, monetary valuation and accounting recognition are related but distinct questions — a Risk Unit is a measure of exposure, not a currency amount.

A Continuously Refreshed Management View

Once exposure is expressed in a consistent unit and its inputs come from systems rather than a periodic questionnaire, measurement can refresh far more often than a reporting cycle allows — in real time or near real time where the data and the implementation architecture genuinely support it. That qualification is deliberate: in most organisations some inputs are automated and some are not, and refresh frequency follows the data.

Where it does work, it changes the questions management can ask:

  • Where is exposure accumulating faster than the controls around it?
  • Which products and services carry the most residual risk, measured the same way?
  • Is growth in this line increasing exposure faster than it is increasing revenue?
  • Has residual risk deteriorated since last month, and in which control area?
  • Which controls are demonstrably effective, and which only appear in a policy?
  • Which remediation would remove the most exposure for the least effort?
  • Should volumes or limits on this activity be adjusted now rather than at the next review?

From Risk Units to the Economics of Risk

This section describes a VODIS implementation hypothesis. It is not part of the RASB standard, and nothing in it should be read as an RASB position.

Risk Accounting produces a measure of exposure. Management decisions, however, are usually taken in money. The bridge VODIS is interested in building is a deliberate, clearly-labelled translation layer: mapping consistently measured inherent and residual risk — using validated assumptions, the organisation's own loss history and forward-looking judgement — to an estimated economic cost of carrying that risk.

Where that translation holds up, risk can enter product economics directly rather than sitting beside them:

  • operating cost
  • funding and capital cost, where applicable
  • distribution and servicing cost
  • estimated economic cost of risk
  • target margin

This is a management model, not an accounting standard and not a loss forecast. The estimate is only as good as the assumptions behind it, and those assumptions belong in the open, where they can be challenged, versioned and tested against what actually happens. VODIS would validate any such model with the organisation's risk and finance functions rather than deliver it as a black box.

Risk-Adjusted Pricing and Profitability

Once a cost of risk can be estimated per product, several decisions that are normally argued qualitatively become comparable:

  • Risk-adjusted product profitability, rather than margin before risk.
  • Pricing that reflects the risk a product actually carries.
  • Comparison across customers, segments and channels where the data supports it.
  • Portfolio decisions about which products to grow, reprice, redesign or retire.
  • Volume and limit setting informed by exposure rather than by appetite alone.
  • Investment in controls assessed against the exposure it would remove.
  • Outsourcing and vendor decisions with the risk consequence priced in.
  • Process redesign targeted where it reduces the most exposure.

The pattern this exposes is familiar, and is described qualitatively here because the real numbers are organisation-specific. A product can look strongly profitable before risk and materially less so once the cost of its residual risk is carried. The same logic runs in the other direction: an investment in controls that lowers residual risk can improve a product's risk-adjusted contribution, and can sometimes create room to price more competitively rather than less.

Existing Risk and Potential Risk

A measurement framework is more useful if it can be run forward as well as backward. Four distinct things are worth keeping separate:

  • Currently observed exposure — what the business is carrying today.
  • Inherent risk — gross exposure before controls are considered.
  • Residual risk — what remains after mitigation is taken into account.
  • Potential risk — what exposure would become under changed volumes, new products, altered controls, different outsourcing arrangements or a defined scenario.

That last category is where the method earns its place in management conversation, supporting questions such as: what happens to our risk-adjusted economics if transaction volumes double? What if control effectiveness here deteriorates? Is the margin on this product sufficient for the risk we are accepting? Would improving this control cost less than carrying the residual risk? These are decision-support questions, not guaranteed predictions, and should not be presented to a board as if they were.

A Continuous Management Loop

Used properly, this is not a reporting exercise but a loop that keeps running:

  • Measure — express exposure consistently across products and services.
  • Quantify — produce inherent and residual risk in a common unit.
  • Compare — rank and contrast across the portfolio.
  • Translate — estimate the economic impact, with assumptions stated.
  • Decide — at the level where the decision actually sits.
  • Act — mitigate, reprice, redesign or limit.
  • Measure again — and see whether the action moved the number.

The last step is most often skipped and is what makes the rest credible: if a control investment does not move residual risk, that is worth knowing.

Risk Accounting Standards Board

The Risk Accounting methodology, its terminology and its standards work are developed and published by the Risk Accounting Standards Board. RASB is the authoritative source for the method itself, and its site and whitepapers are the reference VODIS works from — including its material on measuring operational risk before it becomes loss, and its proposals on the accounting treatment of Risk Units.

VODIS is an implementation and integration practice. It did not invent Risk Accounting, does not own the methodology, and does not claim to be an accredited RASB implementation partner.

Explore Risk Accounting at RASB — rasb.org

Where VODIS Contributes

The methodology is the starting point, not the deliverable. Making it work inside a real organisation is an implementation and integration programme, and that is the part VODIS takes on:

  • Translating the methodology into a workable operating model and governance structure.
  • Building the product and service inventory the measurement depends on.
  • Data sourcing and integration, including connection to transaction systems.
  • Risk taxonomy and data model design.
  • Process and control mapping, and the evidence behind control effectiveness.
  • Technology architecture, automation and the refresh path.
  • Dashboards and management reporting that a board will actually use.
  • Integration with existing Risk, Finance and management reporting rather than beside them.
  • Risk-adjusted product economics, built as an explicit and challengeable model.
  • A pilot implementation on a bounded scope before any enterprise commitment.
  • The change programme and governance around all of it.

A Sensible Starting Point

The most useful first conversation is narrow: one product line or one operational area, the data that already exists for it, and the decisions management would take differently if exposure were measured consistently and refreshed more often.

From there it is usually possible to say quickly whether a bounded pilot is worthwhile, what data work it would require, and what it would take to connect the result to the economics the business already manages.

Discuss operational risk measurement