> ## Documentation Index
> Fetch the complete documentation index at: https://docs.roi4srm.willowflow.group/llms.txt
> Use this file to discover all available pages before exploring further.

# Content references

# References Tab Content Plan

**Version:** 1.0\
**Status:** Draft\
**Date:** 2025-10-10\
**Target Phase:** P2 (References Tab Implementation)

***

## Table of Contents

1. [Overview](#1-overview)
2. [Section 1: ISO 31000 Risk Management Principles](#2-section-1-iso-31000-risk-management-principles)
3. [Section 2: Risk Quantification Principles (EAL)](#3-section-2-risk-quantification-principles-eal)
4. [Section 3: NPV & Discounting Policy (0% Fixed)](#4-section-3-npv--discounting-policy-0-fixed)
5. [Section 4: Qualitative Valuation Approaches](#5-section-4-qualitative-valuation-approaches)
6. [Section 5: Worked Example Walkthrough](#6-section-5-worked-example-walkthrough)
7. [Section 6: Glossary of Terms](#7-section-6-glossary-of-terms)
8. [Section 7: Further Reading & Resources](#8-section-7-further-reading--resources)
9. [UI/UX Considerations](#9-uiux-considerations)

***

## 1. Overview

### 1.1 Purpose

This content plan defines the structure and content for the **References Tab**, which provides transparency into the methodological foundations of the NGO SRM ROI Calculator. The References Tab enables users to:

* Understand the standards and formulas underlying the calculator (ISO 31000, Expected Annual Loss consistent with FAIR/NIST)
* Access detailed guidance on non-discounted valuation rationale and qualitative valuation
* Review a worked example walkthrough
* Look up technical terms in a comprehensive glossary
* Explore further reading for deeper understanding

**Target Audience:** NGO managers, financial analysts, auditors, and anyone seeking to validate or understand the calculator's methodological foundations.

### 1.2 Content Organization

The References Tab is organized into seven sections:

1. **ISO 31000 Risk Management Principles** (summary + link)
2. **Risk Quantification Principles (EAL)** (overview with links to FAIR/NIST resources)
3. **NPV & Discounting Policy (0% Fixed)** (rationale and references for 0% in humanitarian context)
4. **Qualitative Valuation Approaches** (shadow pricing, contingent valuation references)
5. **Worked Example Walkthrough** (interactive or static, mirrors Methods Note example)
6. **Glossary of Terms** (ARO, SLE, EAL, NPV, Payback Period, etc.)
7. **Further Reading & Resources** (academic papers, practitioner guides)

### 1.3 Accessibility

All content will meet WCAG 2.1 AA standards:

* Plain language suitable for NGO practitioners
* Hierarchical structure with clear headings
* Screen reader compatibility
* High-contrast color scheme

***

## 2. Section 1: ISO 31000 Risk Management Principles

### 2.1 Section Overview

**Title:** "ISO 31000: Risk Management Principles"

**Purpose:** Introduce users to the ISO 31000 standard, which underpins the calculator's risk assessment methodology.

### 2.2 Content

<AccordionGroup>
  <Accordion title="What is ISO 31000?">
    #### What is ISO 31000?

    > ISO 31000:2018 is the international standard for risk management, providing principles, framework, and process for managing risk systematically and transparently.
    >
    > **Key Principles:**
    >
    > * **Integrated:** Risk management is part of all organizational activities
    > * **Structured and comprehensive:** Systematic, structured approach contributes to consistent and comparable results
    > * **Customized:** Risk management framework and process are customized to the organization's context
    > * **Evidence-based:** Best available information informs risk assessment and decision-making
  </Accordion>

  <Accordion title="How Does ISO 31000 Apply to This Calculator?">
    #### How Does ISO 31000 Apply to This Calculator?

    > The calculator implements ISO 31000 principles through:
    >
    > 1. **Risk Identification:** Users identify security incidents (threats and vulnerabilities)
    > 2. **Risk Analysis:** ARO (frequency) and SLE (magnitude) quantify likelihood and impact
    > 3. **Risk Evaluation:** EAL (Expected Annual Loss) expresses total risk exposure
    > 4. **Risk Treatment:** Costs represent risk mitigation investments; ROI evaluates treatment effectiveness
    >
    > **Example:** A vehicle theft incident with ARO=0.15 (15% annual probability) and SLE=$35,000 (cost per incident) yields EAL=$5,250 (expected annual loss). This quantification enables evidence-based decisions about whether to invest in vehicle security (e.g., GPS tracking, secure parking).
  </Accordion>

  <Accordion title="Where to Learn More">
    #### Where to Learn More

    > **Full Standard:** ISO 31000:2018 - Risk management — Guidelines\
    > **Website:** [https://www.iso.org/iso-31000-risk-management.html](https://www.iso.org/iso-31000-risk-management.html)\
    > **Summary Document:** [ISO 31000 Overview (PDF)](https://www.iso.org/files/live/sites/isoorg/files/store/en/PUB100426.pdf)
    >
    > **Recommended Reading:**
    >
    > * Purdy, G. (2010). "ISO 31000:2009—Setting a New Standard for Risk Management." *Risk Analysis*, 30(6), 881-886.
    > * Leitch, M. (2010). "ISO 31000:2009—The new international standard on risk management." *Risk Analysis*, 30(6), 887-892.
  </Accordion>
</AccordionGroup>

***

## 3. Section 2: Risk Quantification Principles (EAL)

### 3.1 Section Overview

**Title:** "Risk Quantification Principles (Expected Annual Loss)"

**Purpose:** Explain how the Expected Annual Loss (EAL) formula underpins the calculator's quantitative risk analysis, and clarify how this approach aligns with—but does not fully implement—frameworks like FAIR and NIST RMF.

### 3.2 Content

<AccordionGroup>
  <Accordion title="What Are Risk Quantification Principles?">
    #### What Are Risk Quantification Principles?

    > Quantitative risk analysis separates the frequency of loss events from their magnitude. The Expected Annual Loss (EAL) formula captures this by multiplying how often an incident occurs (`Annualized Rate of Occurrence`) by how costly it is when it happens (`Single Loss Expectancy`). This structure is common across enterprise risk methodologies, including FAIR, NIST Risk Management Framework, and ISO-aligned practices.
  </Accordion>

  <Accordion title="How Do These Principles Apply to This Calculator?">
    #### How Do These Principles Apply to This Calculator?

    > The calculator adopts standard risk quantification terminology:
    >
    > | FAIR Term                  | Calculator Equivalent               | Definition                                                                                            |
    > | -------------------------- | ----------------------------------- | ----------------------------------------------------------------------------------------------------- |
    > | Loss Event Frequency (LEF) | Annualized Rate of Occurrence (ARO) | Expected number of times an incident occurs in a year (ARO ≥ 0; values > 1 for high-frequency events) |
    > | Loss Magnitude (LM)        | Single Loss Expectancy (SLE)        | Cost in dollars if the incident occurs once                                                           |
    > | Loss Expectancy            | Expected Annual Loss (EAL)          | ARO × SLE = Average annual financial impact                                                           |
    >
    > **Important:** The calculator uses the EAL formula consistent with FAIR and similar frameworks but does not implement FAIR’s full methodology (e.g., threat/vulnerability decomposition, probability distributions, Monte Carlo simulation). This keeps the approach accessible for NGO physical and cyber security contexts while remaining mathematically sound.
    >
    > **Example:** A ransomware attack with LEF/ARO=0.20 (20% annual probability, or once every 5 years) and LM/SLE=$75,000 yields Loss Expectancy/EAL=$15,000.
  </Accordion>

  <Accordion title="Where to Learn More">
    #### Where to Learn More

    > **Risk Quantification Resources:**
    >
    > * FAIR Institute: [https://www.fairinstitute.org/](https://www.fairinstitute.org/)
    > * NIST Risk Management Framework: [https://csrc.nist.gov/projects/risk-management](https://csrc.nist.gov/projects/risk-management)
    >
    > **Free Resources:**
    >
    > * [FAIR Introduction (PDF)](https://www.fairinstitute.org/fair-introduction)
    > * [FAIR Risk Quantification Examples](https://www.fairinstitute.org/fair-examples)
    >
    > **Recommended Reading:**
    >
    > * Freund, J., & Jones, J. (2014). *Measuring and Managing Information Risk: A FAIR Approach*. Butterworth-Heinemann.
    > * Jones, J. A. (2005). *An Introduction to Factor Analysis of Information Risk (FAIR)*. Norwich University.
    > * Stoneburner, G., Goguen, A., & Feringa, A. (2002). *Risk Management Guide for Information Technology Systems* (NIST SP 800-30).
  </Accordion>
</AccordionGroup>

***

## 4. Section 3: NPV & Discounting Policy (0% Fixed)

### 4.1 Section Overview

**Title:** "Net Present Value (NPV) and 0% Discounting Policy"

**Purpose:** Document that discounting is fixed at 0% in this tool for humanitarian transparency; explain implications for NPV.

### 4.2 Content

#### What is Net Present Value (NPV)?

> Net Present Value (NPV) converts multi-year costs into a single present-value figure, accounting for the **time value of money**: a dollar today is worth more than a dollar next year.
>
> **Formula:** `NPV = Σ (Cost_t / (1 + r)^(t-1))` for all periods t
>
> Where:
>
> * **Cost\_t:** Cost in period t
> * **t:** Time period (1, 2, 3, ...)
>
> **Policy in this tool:** Discounting is fixed at 0% for humanitarian transparency; discount factors are 1.0 and NPV equals the simple sum across periods.

#### What is a Discount Rate?

> In finance, the discount rate converts future cash flows to present value. In this calculator, we intentionally fix the discount rate at 0% to avoid devaluing future humanitarian outcomes and to improve transparency.

#### Discounting Policy and Sources

> We fix r = 0% in this tool. See Methods Note Sections 3.2 and 6.3 for rationale and references (including World Bank 2023 discussions on 0% for development/sustainability contexts).

#### Sensitivity Considerations

> Discount rate sensitivity is not applicable here (r = 0% fixed). Focus sensitivity on parameters with substantive uncertainty (risk reduction effectiveness, proxy values), per Methods Note Section 5.3.1.

***

## 5. Section 4: Qualitative Valuation Approaches

### 5.1 Section Overview

**Title:** "Valuing Non-Financial Benefits: Qualitative Impact Index"

**Purpose:** Summarise the Stage 1 Qualitative Impact Index workflow: anchor-based scoring, short evidence notes, and optional weight adjustments.

### 5.2 Content

#### Why Track Qualitative Benefits?

> Security investments produce both **quantitative** (risk reduction) and **qualitative** (access, continuity, acceptance, wellbeing) benefits. Quantitative benefits flow straight into the ROI calculation via EAL reduction. Qualitative benefits are captured through a structured scorecard so they can be reported consistently alongside financial metrics.
>
> **Qualitative Factors:**
>
> * **Access to Environment (AE):** Ability to operate in insecure areas
> * **Operational Continuity (OC):** Reduced disruptions and suspensions
> * **Community Acceptance (CA):** Improved local perceptions and relationships
> * **Staff Wellbeing (SW):** Reduced stress, improved morale, retention

#### Stage 1 Qualitative Impact Workflow

> The Stage 1 workflow keeps the process lightweight:
>
> 1. **Select anchors (0–5):** Choose the anchor that best reflects observable change in each dimension. Anchor descriptions focus on directional change and indicative thresholds.
> 2. **Record a short evidence note:** Capture one or two sentences citing the data or observation that informed the score.
> 3. **Optional weight tweaks:** Dimensions default to equal weighting (0.25 each). Adjustments are rare and should only reflect clear stakeholder priorities or programme context.
>
> The calculator reports a single Qualitative Impact Index (QII) on a 0–5 scale. No confidence tiers or monetisation steps are used in Stage 1.

#### Reporting the Qualitative Impact Index

> * **Primary outputs:** Weighted QII score and the dimension-level notes.
> * **Narrative:** Highlight what drove the strongest gains and where further work is needed.
> * **Documentation:** Store anchor selections, weights (if adjusted), and evidence notes in the export pack for auditability.
>
> *Reminder:* Confidence tiers, adjusted QII figures, and monetisation/proxy tables were retired from the Stage 1 methodology.

***

## 6. Section 5: Worked Example Walkthrough

### 6.1 Section Overview

**Title:** "Step-by-Step ROI Calculation: Worked Example"

**Purpose:** Provide an interactive or static walkthrough of a complete ROI calculation using the Baseline synthetic scenario.

### 6.2 Content (Mirrors Methods Note Section 7)

#### Scenario: Baseline Mid-Sized NGO Operations

**Context:** Mid-sized humanitarian NGO in moderate-risk environment investing in comprehensive security program over 3 years.

***

<Steps>
  <Step title="Step 1: Calculate Expected Annual Loss (EAL)">
    **Step 1: Calculate Expected Annual Loss (EAL)**

    | Incident Type          | ARO  | SLE (\$) | EAL (\$) |
    | ---------------------- | ---- | -------- | -------- |
    | Data Breach (Phishing) | 0.30 | 45,000   | 13,500   |
    | Vehicle Theft          | 0.15 | 35,000   | 5,250    |
    | Office Burglary        | 0.25 | 12,000   | 3,000    |
    | Staff Kidnapping       | 0.05 | 250,000  | 12,500   |
    | Ransomware Attack      | 0.20 | 75,000   | 15,000   |

    **Total EAL:** \$49,250
  </Step>

  ***

  <Step title="Step 2: Calculate NPV of Costs">
    **Step 2: Calculate NPV of Costs (r = 0%)**

    | Period | Costs (\$) | Discount Factor | NPV (\$)  |
    | ------ | ---------- | --------------- | --------- |
    | 1      | 90,000     | 1.0000          | 90,000.00 |
    | 2      | 37,000     | 1.0000          | 37,000.00 |
    | 3      | 39,000     | 1.0000          | 39,000.00 |

    **Total NPV:** \$166,000.00
  </Step>

  ***

  <Step title="Step 3: Qualitative Impact Assessment">
    **Step 3: Qualitative Impact Assessment (QII)**

    Equal weights (0.25 each) applied in the Qualitative Impact Assessment.

    | Dimension | Score | Weighted Contribution | Evidence Note (summary)                  |
    | --------- | ----- | --------------------- | ---------------------------------------- |
    | AE        | 4     | 1.00                  | Mission tracker shows +18% site coverage |
    | OC        | 3     | 0.75                  | Downtime reduced from 21 to 16 days      |
    | CA        | 3     | 0.75                  | Joint community forums restarted Q3      |
    | SW        | 2     | 0.50                  | Pulse survey up slightly; retention flat |

    **Qualitative Impact Index (QII):** Σ(weight × score) = **3.00 / 5.0**
  </Step>

  ***

  <Step title="Step 4: Financial Benefits (Discounted EAL)">
    **Step 4: Financial Benefits (Discounted EAL)**

    With discount rate fixed at 0 %, financial benefits equal the annual EAL reduction (Year 1–3):\
    **Total benefits (0% discount)** = $49,250 + $49,250 + $49,250 = **$147,750.00\*\*
  </Step>

  ***

  <Step title="Step 5: Financial ROI">
    **Step 5: Financial ROI**

    **ROI\_financial = ((Benefits\_financial − Costs) / Costs) × 100**\
    \= (($147,750.00 − $166,000.00) / \$166,000.00) × 100\
    \= **−10.99%**
  </Step>

  ***

  <Step title="Step 6: Calculate Payback Period">
    **Step 6: Calculate Payback Period**

    | Year | Cumulative Costs (\$) | Financial Benefits (\$) | Recovered? |
    | ---- | --------------------- | ----------------------- | ---------- |
    | 1    | 90,000                | 49,250.00               | No         |
    | 2    | 127,000               | 98,500.00               | No         |
    | 3    | 166,000               | 147,750.00              | No         |

    **Payback Period:** N/A (financial benefits alone do not recover costs within 3 years)
  </Step>
</Steps>

***

**Summary:**

| Metric                             | Value        | Interpretation                                              |
| ---------------------------------- | ------------ | ----------------------------------------------------------- |
| **EAL**                            | \$49,250     | Average annual risk without intervention                    |
| **NPV**                            | \$166,000.00 | Present value of 3-year security investment                 |
| **Qualitative Impact Index (QII)** | 3.00         | Strong qualitative improvement backed by documented anchors |
| **Financial ROI**                  | −10.99%      | Quantified risk reduction alone does not recover costs      |
| **Payback Period**                 | N/A          | Financial benefits alone do not recover costs in 3 years    |

**Key Insight:** Financial ROI based solely on quantified EAL reduction is negative in this scenario. The Qualitative Impact Index still demonstrates strong improvements in access, continuity, acceptance, and wellbeing, documented through Stage 1 anchors and evidence notes.

***

## 7. Section 6: Glossary of Terms

### 7.1 Section Overview

**Title:** "Glossary: Key Terms and Definitions"

**Purpose:** Provide quick-reference definitions for all technical terms used in the calculator. This section also stores the **UI Terminology Matrix** used to guide plain-language implementation across the application.

***

### 7.2 UI Terminology Matrix (Plain-Language Implementation)

This table maps technical terms to plain-language alternatives and defines where tooltips/glossary links should appear. It guides the **UI Plain-Language Initiative** (see documentation polishing tasks in `.specify/memory/backlog.md`).

| Location                            | Current Label/Text                   | Technical Term          | Plain Language Draft                  | Tooltip Needed?                  | Status     |
| ----------------------------------- | ------------------------------------ | ----------------------- | ------------------------------------- | -------------------------------- | ---------- |
| **AssumptionsStep.tsx:63**          | "Setup"                              | Setup/Assumptions       | "Setup" (retained)                    | No                               | ✅ Approved |
| **AssumptionsStep.tsx:77**          | "Time Horizon"                       | Time Horizon            | "Planning period"                     | Yes (explain 1-10 years)         | 📋 Pending |
| **AssumptionsStep.tsx:80**          | "Discounting is fixed at 0%"         | Discount Rate           | "Fixed at 0% for transparency"        | Yes (link to Methods Note)       | 📋 Pending |
| **AssumptionsStep.tsx:131**         | "Organization Context"               | Context                 | "Organization details (optional)"     | Yes (explain why needed)         | 📋 Pending |
| **AssumptionsStep.tsx:164**         | "Annual Operating Budget"            | Annual Operating Budget | "Your organization's yearly budget"   | Yes (helps estimate costs)       | 📋 Pending |
| **AssumptionsStep.tsx:178**         | "Annual Security Budget"             | Annual Security Budget  | "Current security spending per year"  | Yes (for comparison)             | 📋 Pending |
| **AssumptionsStep.tsx:197**         | "Staff Count (FTE)"                  | FTE                     | "Number of full-time staff"           | Yes (explain FTE)                | 📋 Pending |
| **AssumptionsStep.tsx:226**         | "Programme Delivery Days/Year"       | Programme Delivery Days | "Active work days per year"           | Yes (excludes weekends/holidays) | 📋 Pending |
| **IncidentsStep.tsx:191**           | "Security Incidents"                 | Incidents               | "Security risks and events"           | No                               | 📋 Pending |
| **IncidentsStep.tsx:193**           | ARO                                  | ARO                     | "How often per year"                  | Yes (link to glossary)           | 📋 Pending |
| **IncidentsStep.tsx:193**           | SLE                                  | SLE                     | "Cost per event"                      | Yes (link to glossary)           | 📋 Pending |
| **IncidentsStep.tsx:233**           | "Incident Type \*"                   | Incident Type           | "Type of security risk"               | No                               | 📋 Pending |
| **IncidentsStep.tsx:236**           | ARO header                           | ARO                     | "Expected frequency"                  | Yes (dropdown presets)           | 📋 Pending |
| **IncidentsStep.tsx:241**           | SLE header                           | SLE                     | "Cost if it happens"                  | Yes (budget-relative)            | 📋 Pending |
| **IncidentsStep.tsx:494**           | "Annual Rate of Occurrence (ARO)"    | ARO                     | "How often this happens each year"    | Yes                              | 📋 Pending |
| **IncidentsStep.tsx:509**           | "Single Loss Expectancy (SLE)"       | SLE                     | "What it costs when it happens"       | Yes                              | 📋 Pending |
| **CostsStep.tsx:151**               | "Security Costs"                     | Costs                   | "Security investment costs"           | No                               | 📋 Pending |
| **CostsStep.tsx:193**               | "Category \*"                        | Category                | "What the money is for"               | No                               | 📋 Pending |
| **CostsStep.tsx:197**               | CapEx/OpEx                           | CapEx/OpEx              | "One-time or recurring"               | Yes (explain difference)         | 📋 Pending |
| **CostsStep.tsx:272**               | FinancialTerms.OpEx                  | OpEx                    | "Ongoing costs"                       | Yes (from term registry)         | 📋 Pending |
| **CostsStep.tsx:273**               | FinancialTerms.CapEx                 | CapEx                   | "One-time investments"                | Yes (from term registry)         | 📋 Pending |
| **CostsStep.tsx:302**               | "Period"                             | Period                  | "Which year"                          | Yes (1 to time horizon)          | 📋 Pending |
| **QualitativeStep.tsx:69**          | "Access to Environment (AE)"         | AE                      | "Ability to reach areas"              | Yes (expand definition)          | 📋 Pending |
| **QualitativeStep.tsx:76**          | "Operational Continuity (OC)"        | OC                      | "Keeping programs running"            | Yes (expand definition)          | 📋 Pending |
| **QualitativeStep.tsx:83**          | "Community Acceptance (CA)"          | CA                      | "Local relationships"                 | Yes (expand definition)          | 📋 Pending |
| **QualitativeStep.tsx:90**          | "Staff Wellbeing (SW)"               | SW                      | "Staff safety and morale"             | Yes (expand definition)          | 📋 Pending |
| **QualitativeStep.tsx:325**         | "How to use this step"               | Instructions            | Keep plain                            | No                               | ✅ Approved |
| **QualitativeStep.tsx:334**         | "Assessment Progress"                | Progress                | Keep plain                            | No                               | ✅ Approved |
| **QualitativeStep.tsx:542**         | "Qualitative Impact Index (preview)" | QII                     | "Overall qualitative score (preview)" | Yes (explain 0-5 scale)          | 📋 Pending |
| **ResultsStep (financial metrics)** | "Expected Annual Loss"               | EAL                     | "Average yearly risk cost"            | Yes (without intervention)       | 📋 Pending |
| **ResultsStep (financial metrics)** | "Net Present Value"                  | NPV                     | "Total investment value"              | Yes (r=0%, sum of costs)         | 📋 Pending |
| **ResultsStep (financial metrics)** | "Return on Investment"               | ROI                     | "Value returned per dollar spent"     | Yes (percentage formula)         | 📋 Pending |
| **ResultsStep (financial metrics)** | "Payback Period"                     | Payback Period          | "Years to break even"                 | Yes (may be N/A)                 | 📋 Pending |
| **ResultsStep (qualitative)**       | "Qualitative Impact Index"           | QII                     | "Overall qualitative improvement"     | Yes (0-5 scale, weighted)        | 📋 Pending |
| **Export headers (PDF/Excel)**      | All metric labels                    | Various                 | Add plain language + (technical term) | Yes (in parentheses)             | 📋 Pending |
| **Review cards**                    | Metric summaries                     | Various                 | Plain language with tooltip           | Yes (technical term in tooltip)  | 📋 Pending |

**Legend:**

* ✅ **Approved**: Plain language approved and implemented
* 📋 **Pending**: Awaiting implementation in Phase 2-4 of the UI plan
* 🔄 **In Progress**: Currently being updated

**Usage Notes:**

1. All **plain-language labels** should appear by default in the UI
2. **Technical terms** surface via tooltips (HintTooltip/TermHoverCard) or glossary drawer
3. **Tooltip content** should cite this glossary for consistency
4. **Localisation**: All plain-language strings must be translation-ready (no idioms, paired with icons where helpful)

***

### 7.3 Content

<AccordionGroup>
  <Accordion title="A">
    #### A

    **Annualized Rate of Occurrence (ARO)**
    Expected number of times an incident occurs in a year. ARO ≥ 0; values can be less than 1 (infrequent events) or greater than 1 (high-frequency events).
    *Example:* ARO = 0.25 means "expected once every 4 years." ARO = 12 means "monthly occurrence (12 times per year)."

    **Assumptions**\
    Temporal parameters used in calculations, including time horizon (discounting fixed at 0%), and (when enabled) social value proxies.
  </Accordion>

  <Accordion title="C">
    #### C

    **CAPEX (Capital Expenditure)**\
    One-time asset purchases with multi-year lifespans (e.g., vehicles, equipment, facility upgrades).

    **Cost**\
    Security risk management investment cost incurred in a specific period.
  </Accordion>

  <Accordion title="D">
    #### D

    **Discount Rate**\
    Set to 0% in this calculator to avoid devaluing future humanitarian outcomes and improve transparency. Standard finance uses positive rates; we document the rationale in Methods Note Sections 3.2 and 6.3.
  </Accordion>

  <Accordion title="E">
    #### E

    **Expected Annual Loss (EAL)**\
    Average annual financial impact of security incidents over time, calculated as `Σ (ARO × SLE)` for all incidents.\
    *Example:* EAL = $49,250 means "average annual loss of $49,250 from identified risks."
  </Accordion>

  <Accordion title="F">
    #### F

    **FAIR Framework (reference)**
    Factor Analysis of Information Risk – a quantitative risk analysis methodology for information security. The calculator references FAIR for the Expected Annual Loss formula but does not implement the full FAIR framework.
  </Accordion>

  <Accordion title="I">
    #### I

    **Incident**\
    Security incident type with expected frequency (ARO) and financial impact (SLE).

    **ISO 31000**\
    International standard for risk management, providing principles, framework, and process for managing risk systematically.
  </Accordion>

  <Accordion title="N">
    #### N

    **Net Present Value (NPV)**\
    Present value of multi-year costs; in this tool with r = 0%, discount factors are 1.0 and NPV equals the simple sum across periods.\
    *Example:* NPV = $166,000.00 for a 3-year security program (sum of $90k, $37k, $39k).
  </Accordion>

  <Accordion title="O">
    #### O

    **OPEX (Operating Expenditure)**\
    Recurring operational costs, typically annual (e.g., salaries, training, maintenance).
  </Accordion>

  <Accordion title="P">
    #### P

    **Payback Period**\
    Time (in years) required for cumulative benefits to equal or exceed cumulative costs.\
    *Note:* Uses discounted benefits for conservative estimate.

    **Parameter Delta**\
    Qualitative valuation method that adjusts quantitative parameters (ARO, SLE) based on qualitative scores.
  </Accordion>

  <Accordion title="Q">
    #### Q

    **Qualitative Benefits**\
    Non-financial improvements from security investments (access, continuity, acceptance, wellbeing).

    **Qualitative Model**\
    Framework for capturing qualitative benefits using weighted scoring (AE, OC, CA, SW).
  </Accordion>

  <Accordion title="R">
    #### R

    **Return on Investment (ROI)**\
    Financial return as a percentage of investment cost, calculated as `((Benefits - Costs) / Costs) × 100`.\
    *Example:* ROI = 25% means "for every $1 invested, quantified benefits exceed costs by $0.25." A negative ROI indicates quantified benefits do not fully offset costs within the analysis period.
  </Accordion>

  <Accordion title="S">
    #### S

    **Scenario**\
    Complete risk analysis case bundling incidents, costs, assumptions, and qualitative scores.

    **Shadow Price / Proxy Value**\
    Stakeholder-approved financial proxy used when monetising qualitative improvements (e.g., value per programme day, cost of downtime avoided).\
    *Guidance:* Only apply when data sources, approvals, and sensitivity ranges are documented.

    **Single Loss Expectancy (SLE)**\
    Expected cost in dollars if an incident occurs once.\
    *Example:* SLE = \$45,000 for a data breach (IT recovery + regulatory fines + reputation damage).
  </Accordion>

  <Accordion title="T">
    #### T

    **Time Horizon**\
    Number of years over which costs and benefits are evaluated.\
    *Recommended range for NGOs:* 3 to 5 years.
  </Accordion>
</AccordionGroup>

***

## 8. Section 7: Further Reading & Resources

### 8.1 Section Overview

**Title:** "Further Reading: Academic Papers and Practitioner Guides"

**Purpose:** Curate high-quality resources for users seeking deeper understanding.

### 8.2 Content

#### Risk Management Standards

**ISO 31000:2018 - Risk Management Guidelines**\
International Organization for Standardization (2018). *ISO 31000:2018 - Risk management — Guidelines*.\
[https://www.iso.org/iso-31000-risk-management.html](https://www.iso.org/iso-31000-risk-management.html)

**Risk Quantification Resources (EAL)**\
FAIR Institute (2020). *Factor Analysis of Information Risk (FAIR) — Introduction to Risk Quantification*.\
[https://www.fairinstitute.org/](https://www.fairinstitute.org/)\
*Note: Referenced for the Expected Annual Loss formula; the calculator does not implement the full FAIR framework.*

**Recommended Articles:**

* Purdy, G. (2010). "ISO 31000:2009—Setting a New Standard for Risk Management." *Risk Analysis*, 30(6), 881-886.
* Freund, J., & Jones, J. (2014). *Measuring and Managing Information Risk: A FAIR Approach*. Butterworth-Heinemann.

***

#### Financial Analysis Methods

**Brealey, R. A., Myers, S. C., & Allen, F. (2019)**\
*Principles of Corporate Finance* (13th ed.). McGraw-Hill Education.\
\[Standard reference for NPV and capital budgeting]

**World Bank (2023)**\
Guidance discussions on using 0% discount rates in sustainability/development contexts.\
\[Cited in Methods Note Sections 3.2 and 6.3]

***

#### Qualitative Valuation

**Freeman, A. M., Herriges, J. A., & Kling, C. L. (2014)**\
*The Measurement of Environmental and Resource Values: Theory and Methods* (3rd ed.). RFF Press.\
\[Shadow pricing and stated preference methodologies]

**Mitchell, R. C., & Carson, R. T. (1989)**\
*Using Surveys to Value Public Goods: The Contingent Valuation Method*. Resources for the Future.\
\[Contingent valuation for non-market goods]

***

#### NGO Security Risk Management

**Global Interagency Security Forum (GISF). (2021)**\
*Security Risk Management: NGO Approach*.\
[https://gisf.ngo/](https://gisf.ngo/)

**Stoddard, A., Harmer, A., & DiDomenico, V. (2009)**\
*Providing Aid in Insecure Environments: 2009 Update*. Humanitarian Policy Group, ODI.\
[https://www.odi.org/](https://www.odi.org/)

**EISF (European Interagency Security Forum)**\
*Incident Tracking and Analysis: Best Practices for NGOs*.\
[https://www.eisf.eu/](https://www.eisf.eu/)

***

#### Project-Specific Documentation

**Methods Note**\
`specs/001-develop-a-user/methods-note.md`\
\[Comprehensive methodological framework for all calculation formulas]

**Data Schema & Codebook**\
`specs/001-develop-a-user/data-schema.md`\
\[Authoritative data reference for all entities, fields, and validation rules]

**Pilot Pack & Data Readiness Guide**\
`specs/001-develop-a-user/pilot-pack.md`\
\[Step-by-step guidance for NGO data preparation and pilot facilitation]

**Validation Report**\
`specs/002-close-rfq-driven/validation/validation-report.md`\
\[Verification of formula-implementation alignment and edge case testing]

***

## 9. UI/UX Considerations

### 9.1 Content Presentation

**Layout:**

* **Sidebar Navigation:** Jump links to each section (ISO 31000, Risk Quantification, NPV, Qualitative, etc.)
* **Collapsible Sections:** Expand/collapse sections for easier navigation
* **Search Functionality:** Full-text search across all reference content
* **Print/Export:** "Export References as PDF" button for offline access

**Accessibility:**

* **WCAG 2.1 AA Compliance:** High-contrast text, keyboard navigation, screen reader compatibility
* **Plain Language:** Avoid jargon where possible; define technical terms on first use
* **Visual Aids:** Diagrams for NPV calculation, qualitative valuation flow charts

### 9.2 Interactive Elements

**Worked Example:**

* **Interactive Calculator (Optional):** Users can adjust inputs in worked example and see live updates
* **Static Walkthrough (Minimum):** Step-by-step presentation with explanatory text and tables

**Glossary:**

* **Alphabetical Index:** Quick navigation to terms by letter
* **In-Line Definitions:** Hover tooltips for glossary terms throughout the References tab

**External Links:**

* **Clearly Marked:** External links open in new tab with visual indicator (↗)
* **Accessible Alternatives:** Provide alternative access for paywalled academic papers (e.g., link to Google Scholar, ResearchGate)

### 9.3 Performance

**Load Time:** less than 3s for full References tab content (optimize with lazy loading for sections)

**Search Performance:** less than 500ms for full-text search results

***

## Document Control

**Version:** 1.0\
**Status:** Draft\
**Date:** 2025-10-10\
**Next Review:** Upon P2 implementation kickoff

**Change Log:**

| Date       | Version | Changes                                            | Author        |
| ---------- | ------- | -------------------------------------------------- | ------------- |
| 2025-10-10 | 1.0     | Initial draft - References tab content plan for P2 | Shayan Seyedi |

***

**End of References Tab Content Plan**

For calculation methodologies, see the Methods Note. For data preparation, see the Pilot Pack & Data Readiness Guide.