Costs of risk: prevention, transfer and contingent liabilities
The Green Book splits the cost of risk into impact costs, correction costs and prevention costs. Spending to prevent, reduce, transfer or avoid a risk is a prevention cost and goes into the proposal's core costs, while risk transfer aims to give each risk to the party best able to manage it.
Three kinds of cost
Impact costs occur when a risk materializes, such as lost service during a system outage. Correction costs are the cost of recovering, such as bringing the system back online. Prevention costs pay for measures to prevent, reduce, transfer or avoid a risk, such as investing to make the system more resilient.
A mitigation usually costs money now and saves impact and correction costs later. The Green Book says to weigh those costs and benefits to judge whether, and how far, the mitigation is value for money. Lowering a risk is not enough on its own.
Where each cost goes
Prevention costs go in the core costs of the proposal. Contingency is separate: it covers residual risk, meaning the optimism bias adjustment that remains plus the value of risks not prevented. Paying a second supplier to stand ready in case the main one fails is a prevention cost, so it belongs in core costs.
Contingent liabilities are potential future costs that arise only if certain events occur. The Green Book's example is the cancellation charge if a contract is ended early. They are appraised and included in the expected cost of risk.
Transferring risk
Transferring risk to a contractor usually has a price, so weigh its benefits against that cost. The Green Book says the purpose is not to transfer every risk, but to allocate each specific risk to the organization best able to manage it.
Where the exam catches people
Believing any measure that lowers risk should be funded: the Green Book weighs its prevention cost against the impact and correction costs it saves.
Believing prevention spending belongs in contingency: it goes in the core costs; contingency covers residual risk.
Believing the best contract pushes all risk onto the contractor: risks go to the party best able to manage them.
Believing early-termination fees are ignored until they happen: they are contingent liabilities, included in the expected cost of risk.