Explore a planning scenario for potential vendor compliance penalty exposure using an entered event count, penalty amount, probability, mitigation effect, and response cost. The result shows both the gross maximum and a risk-adjusted value. Laws, contracts, regulator discretion, defenses, insurance, and jurisdiction-specific caps may materially change actual exposure, so the inputs should come from a documented legal and risk review.
Expected exposure = events × penalty per event × probability × (1 − mitigation reduction) + response cost
Gross maximum exposure excludes probability and mitigation adjustments.
The main result combines an expected-value penalty scenario with response cost. It is a budgeting aid, not a forecast or legal conclusion.
This planning estimate is not legal advice; confirm obligations, limitation periods, and enforcement rules with qualified counsel and the relevant authority.
Two events at $100,000 each create $200,000 gross exposure. At 15% probability and 30% mitigation, the risk-adjusted penalty is $21,000. Adding $25,000 response cost gives $46,000.
No. It is a planning calculation based only on the values entered and does not determine legal obligations or outcomes.
Use controlling policy or legal values for requirements and measured operating data for time, cost, probability, or workload assumptions.
Run separate low, expected, and high scenarios and document the source and date of every assumption.
No. Compliance also depends on scope, controls, evidence, implementation quality, and the applicable jurisdiction or contract.
Recalculate after a rule, policy, contract, workload, staffing level, cost, control, or risk assumption changes.
| Output | Definition |
|---|---|
| Gross maximum | Events × penalty per event |
| Adjusted penalty | Gross × probability × remaining exposure |
| Total exposure | Adjusted penalty + response cost |