Risk Reduction Leverage (RRL) Calculation

Risk Reduction Leverage (RRL)

• RRL is a metric that evaluates the effectiveness of risk mitigation strategies by comparing the reduction in risk exposure to the cost of implementing a mitigation or risk reduction countermeasure.
• RRL is calculated as: RRL = REbefore - REafter / C
• REbefore is the risk exposure before (or without) mitigation.
• REafter is the risk exposure after (or with) mitigation.
• C is the cost of mitigation, which must be in the same units as the RE.

Interpreting RRL

• An RRL greater than 1 indicates that the risk mitigation strategy is worthwhile, as the risk exposure reduction is more than the cost of mitigation.
• An RRL of less than 1 suggests that the risk reduction might not justify the cost of mitigation.

Example of Risk Reduction Leverage

• A 20% chance (probability of occurrence) of a security breach in software could result in a R1 million loss (potential impact).
• Implementing additional firewalls could reduce the probability of occurrence to 10%.
• The cost of implementing firewalls is R50,000.
• The RRL metric helps evaluate whether the risk reduction justifies the cost of mitigation in this scenario.