toolbox
Home / AI, Data & Technology / Third Party Risk Expected Loss Estimator

Third Party Risk Expected Loss Estimator

This estimator calculates annual expected loss from third-party incidents by combining event frequency, the probability that an event causes loss, direct and indirect loss per event, and the portion expected to be recovered. It is suited to vendors, cloud providers, processors, and other external dependencies.

The result gives procurement, security, and risk teams a common monetary scenario for comparing suppliers or deciding where stronger contract terms, insurance, monitoring, or contingency plans may be justified.

Scenario inputs

events
%
USD
USD
%
Result
—
Annual expected loss
Gross loss per event—
Net loss per event—
Expected damaging events—

1. Estimate event frequency
Enter how many relevant events or exposures occur in a typical year.

2. Set loss probability
Enter the percentage of those events expected to produce a financial loss.

3. Enter direct impact
Include response, replacement, legal, technical, or transaction costs directly caused by a damaging event.

4. Enter indirect impact
Add downtime, customer, productivity, or opportunity costs that reasonably belong to the scenario.

5. Apply recovery
Enter the share expected to be recovered or reimbursed.

6. Review annual loss
Use the result as a comparable scenario estimate for control and contingency decisions.

Net loss per damaging event = (Direct loss + Indirect loss) × (1 − Recovery share) Annual expected loss = Events per year × Loss probability × Net loss per damaging event

The model treats each event as having the same average impact. Recovery may represent insurance, contractual reimbursement, chargeback, salvage, or other offsets that are reasonably expected.

What the result means

The displayed value is a scenario estimate for third-party incidents. Use it to compare assumptions and priorities rather than as a guaranteed outcome.

Do not treat every vendor event as identical; segment critical suppliers when their loss profiles differ materially.

Given: 3 events per year, 25% probability of loss, $90,000 direct loss, $60,000 indirect loss, and 20% recovery.

Calculation: Net loss per event = ($90,000 + $60,000) × (1 − 0.20) = $120,000. Expected damaging events = 3 × 0.25 = 0.75. Annual expected loss = 0.75 × $120,000 = $90,000.

Result: The modeled annual expected loss is $90,000.

Is expected loss the same as the worst-case loss?

No. Expected loss is probability-weighted and usually lower than a severe single-event outcome.

What counts as an event?

Use a clearly defined unit, such as a vendor incident, access failure, or confirmed control exception. Keep that definition consistent with the probability input.

Should recovered amounts reduce direct or indirect loss?

This model applies recovery to the combined loss. Use a separate calculation when recovery applies only to specific cost categories.

Can event frequency be a decimal?

Yes. A value such as 0.5 represents one event every two years on average.

How should rare, high-impact events be handled?

Run a separate scenario with its own frequency, probability, and impact instead of blending it into routine events.