Risk
Exposure range
An indicative magnitude derived from the count and severity of failed controls, printed as a rounded band and never as an exact figure.
What it is
A severity band assigned once per distinct failed control, summed, and rounded outward onto a ladder of round numbers.
What it is not
- Not actuarial
- Not derived from external breach-loss statistics, claims data or any third-party loss dataset
- Not a likelihood. It contains no probability term
- Not a prediction of loss to your organisation
- Not a costing of remediation or incident handling
Why the exact sum is never printed
Summing per-control bands produces a figure with far more apparent precision than the inputs carry. Seven significant figures on a board page invites a reader to treat an order-of-magnitude judgement as a measurement.
Below the floor it reads as a below-threshold label; above the ceiling, as an above-threshold label.
What is excluded
Cloud cost recovery, which is a real recoverable operating cost and is reported separately, so the two are never conflated.
What it does mean
That more failed controls, and more severe ones, imply a larger governance exposure. The direction is meaningful. The precision is not.