In a risk assessment exercise of a software implementation program, the business analyst (BA) has successfully computed the probability of occurrence (POC) and the cost of impact for each of the…

Natural disasters have a lower combined expected value when probability is multiplied by cost of impact compared to power surges, resulting in a lower overall negative impact to value.

Power surges carry the highest negative impact to value because their computed expected value - probability of occurrence multiplied by cost of impact - exceeds that of the other identified risks in the assessment table. Even a moderately high probability combined with a severe cost of impact can produce an expected loss that outweighs risks with higher frequency but lower per-incident impact. This makes power surges the priority risk requiring the most immediate mitigation planning.

Human errors, despite potentially high frequency, produce a lower expected loss value when their probability is multiplied by their cost of impact compared to the power surge calculation.

System security risks yield a lower probability-times-impact product than power surges, ranking them below power surges in overall negative impact to value.