​

Methods Note: NGO Security Risk Management ROI Calculator

​

Table of Contents

1. Introduction
2. Methodological Framework
3. Expected Annual Loss Methodology
4. Risk Reduction Rates
5. Financial Metrics
6. Qualitative Valuation
7. Scenario Logic and Workflow
8. Worked Example
9. Edge Cases and Data Quality
10. Assumptions, Limitations, and Future Refinement
11. Validation Roadmap
12. References

​

1. Introduction

​

1.1 Purpose

​

1.2 Scope

​

1.3 Reporting Decision Guide

START
  ↓
Do you have reliable historical incident cost data?
  NO → Use scenario presets and report QII with qualitative narrative
  YES → Report Historical-Cost ROI + QII

• Financial ROI + QII (recommended default): Present quantitative savings alongside qualitative outcomes.
• Qualitative-only reporting: When quantitative data are incomplete, document the QII evidence notes so improvements remain transparent.

​

2. Methodological Framework

​

2.1 Standards and Reference Points

• ISO 31000:2018 Risk Management Guidelines¹ – Emphasises evidence-based decision-making and transparency in documenting risk treatments.
• Humanitarian Financial Stewardship – Prefers demonstrated impact grounded in actual spend rather than speculative forecasts; aligns with practice in donor audits and post-incident reviews.
• Conventional Financial Analysis – ROI, NPV, and Payback formulas follow accepted corporate finance practice, with a zero-discount convention to reflect humanitarian ethics.
• Professional Judgment with Validation – Initial parameter estimates use conservative professional judgment and are explicitly flagged for refinement during Stage 5 pilots.

​

2.2 Calculation Flow

​

2.3 Design Principles

• KISS First: The default workflow delivers results in minutes with only two numeric inputs (historical cost, reduction rate).
• Evidence-Lite, Evidence-Honest: When precise data are unavailable, conservative estimates are surfaced with clear labels and guidance.
• Transparency: All assumptions are visible in the calculator and repeatable from this Methods Note.
• Optional Granularity: An advanced ARO × SLE mode remains available for organisations that require incident-level decomposition and aligns with legacy workflows.

​

3. Expected Annual Loss Methodology

​

3.1 Baseline EAL from Historical Costs

EAL_baseline = Σ(incident costs over last N years) / N

• N is 1–3 years based on available records (minimum 1 year required).
• Incident costs include all direct and indirect expenses (evacuation, medical, programme disruption, legal, reputational response).

• Uses “known actuals” rather than speculative forecasts.
• Aligns with financial audit practice: prior-year losses are the best available proxy for near-term expectations when environment and exposure remain similar.
• Keeps cognitive load low for non-financial security managers.

• If a year is anomalously low (no incidents) or high (major crisis), encourage a 3-year average.
• When operations are scaling up or down, adjust with an exposure factor:

EAL_adjusted = EAL_baseline × (Projected Exposure / Historical Exposure)

​

3.1.1 Historical Baseline Calculation

1. Validate inputs – confirm all values are non-negative and represent full incident costs.
2. Average – EAL_baseline = (50,000 + 45,000 + 55,000) / 3 = 50,000.
3. Document rationale – log the data source (finance ledger + security incident log) for audit trail.

• Use three years whenever data exist; this smooths spikes caused by rare, high-severity incidents.
• Use two years when one year is unavailable or clearly anomalous.
• Fall back to one year only when no additional data exist—flag the baseline as provisional and revisit once more data become available.
• If a known change in exposure occurred (programme doubled or halved), scale the historical average using the exposure adjustment shown earlier.

​

3.2 Handling Limited Data: Scenario Fallback

​

3.3 Intervention EAL and Annual Savings

EAL_intervention = EAL_baseline × (1 - r)
Annual Savings = EAL_baseline - EAL_intervention

​

3.3.1 Intervention EAL Calculation (Example and Rate Clamping)

1. Select reduction rate – choose a comprehensive SRM programme with moderate confidence (r = 0.50).
2. Apply formula
   • EAL_intervention = 50,000 × (1 - 0.50) = 25,000
   • Annual Savings = 50,000 - 25,000 = 25,000
3. Clamp unrealistic inputs – reduction rates are limited to 0–95% in the implementation. ISO 31000-aligned risk reviews emphasise residual risk; setting a 95% ceiling avoids implying total elimination of threat and prevents negative EAL values. Any analyst-supplied rate above 95% is automatically capped and should trigger additional justification in the assumption log (e.g., “eliminates a single hazard entirely while others remain”).
4. Record assumptions – document the intervention category, confidence level, and evidence (e.g., GISF case studies) for audit purposes.

​

3.4 Advanced Option: Incident-Level ARO × SLE

EAL = Σ (ARO_i × SLE_i)

​

3.5 Parameter Guidance for Advanced Mode

• Range: ≥ 0.00 (no upper limit).
• Rare events (ARO < 1) should be expressed as “once every X years” (ARO = 1 / X).
• Frequent events (ARO ≥ 1) can be recorded as incidents per year (monthly = 12, weekly = 52).
• Very high values (>10) often indicate operational costs rather than stochastic risk; double-check whether the incident should be budgeted directly.

• Range: ≥ $0.
• Include both direct costs (damage, medical, ransom) and indirect costs (downtime, reputational recovery).
• When historical data are sparse, supplement with insurance estimates, sector benchmarks, or the severity helper in Section 6.7.

• Allowed range: 1–10 years.
• Match horizon to asset lifespan (e.g., 5 years for vehicles, 10 years for facilities) and funding certainty.

​

4. Risk Reduction Rates

​

4.1 Quick-Select Reduction Table

1. Select the intervention category that best matches the planned investment.
2. Choose Conservative, Moderate, or Optimistic based on confidence in implementation quality and contextual fit.
3. The calculator displays the underlying percentage and allows fine-tuning (e.g., adjusting 25% to 27%).
4. Record a short rationale for governance and future refinement.

• Physical Security (30% moderate) – e.g., compound hardening plus vetted guarding at a provincial office reduced burglary and vandalism costs by one-third within six months.
• Training (25% moderate) – multi-cohort HEAT rollout with quarterly refreshers reduced incident-triggered downtime by an estimated 25%.
• Technology (40% moderate) – vehicle tracking and redundant comms lowered convoy losses by roughly two-fifths during a 12‑month pilot.
• Comprehensive Programme (50% moderate) – integrated governance, training, and technology bundle (paired with community acceptance work) halved annualised security losses across three operating regions.

​

4.2 Evidence and Methodological Basis

• The quick-select reduction percentage is the headline number applied in the calculator.
• The evidence table provides the narrative justification and can be used to decompose reductions into frequency (ARO) vs impact (SLE) components when stakeholders require transparency.
• All selected rates must be documented in the calculator’s assumption log with reference to data source (historical performance, literature citation, expert interview).

​

4.3 Sensitivity Guidance

​

5. Financial Metrics

​

5.1 Annual Savings and Benefit Stream

​

5.2 Return on Investment (ROI)

ROI = ((Σ Annual Savings) - Total Investment Costs) / Total Investment Costs

• Summation typically runs over a 3-year horizon with 0% discounting.
• ROI is expressed as a decimal or percentage (multiply by 100).
• Positive ROI indicates cost savings exceed investment costs.

​

5.2.1 ROI Worked Example

• Annual Savings: $25,000
• Time Horizon: 3 years
• Investment Costs: Year 1 = $40,000, Year 2 =$12,000, Year 3 = $12,000

1. Aggregate savings: Σ Savings = 25,000 × 3 = 75,000.
2. Aggregate costs: Σ Costs = 40,000 + 12,000 + 12,000 = 64,000.
3. ROI calculation: ROI = (75,000 - 64,000) / 64,000 = 0.1719 (17.19%).

​

5.3 Payback Period

Payback Year = smallest Y where Σ_{t=1..Y} Savings_t ≥ Σ_{t=1..Y} Costs_t

Payback = (Y - 1) + (Remaining Costs / Savings in Year Y)

​

5.4 Net Present Value (NPV) and Discounting Rationale

NPV = Σ (Costs_t)  with r = 0%

1. Lives have equal value across time: A beneficiary protected in Year 3 has the same intrinsic worth as one protected in Year 1.
2. Mission alignment: Unlike for-profit enterprises maximising financial returns (which use 7–10% discount rates reflecting opportunity cost of capital), NGOs maximise human welfare.
3. Philosophical foundation: Ramsey (1928) condemned discounting future welfare as “ethically indefensible.” ²
4. Humanitarian precedent: The Stern Review (2006) used near-zero discounting (1.4%) to avoid devaluing future lives in climate policy. ³
5. Intergenerational equity: Zero discounting ensures current investments benefit future staff, communities, and beneficiaries without temporal discrimination.
6. Practical safeguard: Leaving discounting decisions to end users risks inconsistent application; the calculator instead provides a neutral baseline and guidance for external re-application if required.

​

5.5 Time Horizon Sensitivity

​

6. Qualitative Valuation

​

6.1 Framework Overview

1. Access to Environment (AE) – ability to reach and operate in critical locations.
2. Operational Continuity (OC) – reduced downtime and faster recovery after incidents.
3. Community Acceptance (CA) – strengthened social licence and community support.
4. Staff Wellbeing (SW) – improved morale, retention, and duty of care.

​

6.2 Dimension Overview and Weighting

​

6.3 Scoring Workflow

1. Regression check: If deterioration is observed, select the regression statement, record evidence, and assign score 0 (skip improvement statements).
2. Improvement checklist: Tick each statement that accurately describes the past 12 months relative to baseline. Prompts rely on operational knowledge rather than formal datasets.
3. Map ticks to score: Convert the number of improvement statements ticked to the 0–5 scale using Table 6.1.

​

6.4 Dimension Checklists

​

Access to Environment (AE)

• ☐ We regained access to at least one high-priority location that had been closed.
• ☐ The regained access has been sustained for six months or more without emergency waivers.
• ☐ Most critical locations are now reachable on routine rotas with predictable approvals.
• ☐ We reached additional communities or beneficiaries because of the improved access.

​

Operational Continuity (OC)

• ☐ We had fewer security-driven suspensions or closures than last year.
• ☐ After incidents, teams resumed work within planned timelines (e.g., back on schedule within the expected window).
• ☐ Contingency plans or backup sites kept essential services running during disruptions.
• ☐ We met donor/programme deliverables despite security incidents, without accumulating large backlogs.

​

Community Acceptance (CA)

• ☐ Community complaints or incident reports linked to acceptance issues dropped noticeably.
• ☐ We have a regular forum or liaison mechanism that community representatives attend.
• ☐ Community leaders helped resolve at least one security or access issue before it escalated.
• ☐ Recent feedback (surveys, partner letters, third-party reviews) points to strong support or trust.

​

Staff Wellbeing (SW)

• ☐ Security-related turnover, sick leave, or exceptional R&R requests decreased.
• ☐ Uptake of wellbeing resources (counselling, peer support, check-ins) increased.
• ☐ Supervisors run routine wellbeing check-ins after incidents or high-stress periods.
• ☐ Staff surveys or pulse checks report feeling safer and better supported.

​

6.5 Aggregation and Reporting

QII_t = Σ_d (w_d × score_d,t)

• Financial outputs: ROI, NPV, payback, annual savings.
• Qualitative summary: QII score, dimension-level scores, and concise evidence notes explaining which statements were selected.
• Confidence signals: Optional High / Medium / Low tags to flag anecdotal evidence or data gaps.

​

6.6 Limitations and Mitigations

• Evidence gaps: Record qualitative notes for each score and track follow-up actions when stronger evidence is desired.
• Double counting risk: Keep the four dimensions conceptually distinct so the same improvement is not scored twice.
• Scenario spillover: When qualitative gains also affect EAL (e.g., better acceptance reduces incidents), record the change in only one part of the model and note the rationale.
• Periodic review: Refresh qualitative scores at least annually to ensure they reflect current realities and to capture regression when environments deteriorate.

​

6.7 Optional SLE Severity Helper (Advanced Mode)

• When an annual budget is provided, the SLE input offers the severity dropdown with pre-computed mid-point values; users can override with custom amounts at any time.
• Without budget data, the standard numeric SLE input is displayed.
• The helper is a guide only—historical incident costs, insurance data, or expert judgment should take precedence whenever available.

​

7. Scenario Logic and Workflow

1. Quick-Start (Default):
   • Prompt 1: “Do you have the total cost of security incidents for the last year (or average of last 2–3 years)?”
   • Prompt 2: “Choose the expected reduction from your planned investment.”
   • Output: Baseline EAL, Intervention EAL, Savings, ROI, Payback, QII placeholder.
2. Scenario Fallback:
   • If the user selects “No data,” display the scenario cards from Section 3.2.
   • Allow optional override and collect a confidence tag (High / Medium / Low).
3. Exposure Adjustment (Optional):
   • If operations are expected to scale materially, prompt for exposure ratios (e.g., projected staff-days ÷ historical staff-days) and apply the multiplier from Section 3.1.
   • Hidden by default to keep the quick-start path uncluttered.
4. Advanced Mode (Optional):
   • Toggle reveals incident-level entry for ARO and SLE.
   • Results reconcile with the primary method to maintain trust with analysts who prefer granular modelling.
5. Results Presentation:
   • Dashboard shows annual savings, ROI, payback, and qualitative highlights.
   • Sensitivity control (±10%) illustrates how results change if reduction rates vary.

​

8. Worked Example

1. Historical Costs: $225,000 total over the last 3 years → `EAL_baseline = 225,000 / 3 =$75,000`.
2. Reduction Rate: Select “Moderate – Comprehensive SRM (50%)”.
3. Intervention EAL: 75,000 × (1 - 0.50) = $37,500.
4. Annual Savings: 75,000 - 37,500 = $37,500.
5. Investment Costs: Year 1 = $90,000; Year 2 =$45,000; Year 3 = $25,000 (training refresh).
6. ROI (3-year horizon):
   • Total Savings (3 years) = $112,500
   • Total Costs = $160,000
   • ROI = (112,500 - 160,000) / 160,000 = -0.297 (−29.7%)
7. Payback:
   • Year 1 savings = 37,500 (costs exceed benefits)
   • Year 2 cumulative savings = 75,000 (below cumulative costs of 135,000)
   • Year 3 cumulative savings = 112,500 (below total costs of 160,000)
   • Payback occurs in Year 5 if savings remain constant (160,000 ÷ 37,500 ≈ 4.3 years).
8. Extended Horizon Sensitivity:
   • 5-year savings: $187,500 → ROI = (187,500 - 160,000) / 160,000 = 17.2%
   • 10-year savings: $375,000 → ROI = 134.4%
   • Communicate both 3-year baseline and extended horizon to decision-makers.
9. QII:
   • Access (tick 3 statements) = score 4
   • Continuity (tick 2 statements) = score 3
   • Acceptance (tick 1 statement) = score 2

• Staff wellbeing (tick 2 statements) = score 3
• Weighted QII = 0.25 × (4 + 3 + 2 + 3) = 3.0.

​

9. Edge Cases and Data Quality

• Zero incidents recorded: When users enter $0 historical costs, the calculator prompts them to (a) select a scenario preset or (b) manually enter a proxy baseline. If they proceed with $0, the tool sets EAL_baseline = 0, Savings = 0, and ROI = -100% to avoid division errors, while displaying a red “Data required” badge.
• One-off catastrophic year: Users can apply either a three-year rolling average or a manual cap. When EAL_capped is supplied, the calculator records EAL_baseline = MIN(avg_3yr, EAL_capped) and logs the override note in the audit trail. Dashboard badges flag capped baselines in amber.
• Rapid scaling (exposure change): Provide projected and historical exposure values (e.g., staff-days). The tool applies EAL_adjusted = EAL_baseline × (Projected / Historical) and stores the ratio for audit. Sensitivity output shows both original and adjusted baselines.
• Low confidence in reduction rate: Selecting the “Low confidence” toggle displays ±10% scenario bands next to the main result and annotates the export. This ensures decision-makers see conservative and optimistic variants.
• Switching to Advanced Mode: The calculator sums incident-level Σ(ARO_i × SLE_i) and compares it with the baseline. Variance beyond ±10% surfaces a warning requiring users to reconcile assumptions before proceeding.

​

10. Assumptions, Limitations, and Future Refinement

1. Historical Stability: Assumes incident patterns in the near future resemble recent history unless exposure changes are documented.
2. Single Reduction Rate: Applies one rate across all incident types; further granularity is available only in Advanced Mode.
3. Conservative Estimates: Reduction ranges are intentionally modest; Stage 5 pilots will validate and adjust them.
4. Zero Discounting: Prioritises ethical parity over the financial cost of capital. Organisations needing discounting can apply it externally.
5. Qualitative-Quantitative Separation: Prevents double counting but requires disciplined storytelling to integrate both dimensions.

​

11. Validation Roadmap

• Scenario Presets: Validate against pilot NGO incident datasets. Adjust baseline values if variance exceeds ±30%; publish updated ranges in Methods Note v2.2.
• Reduction Rates: Conduct rapid expert elicitation (5–10 SRM managers) and reconcile with pilot outcomes. Update table bands if consensus differs by >10 percentage points.
• Qualitative Framework: Gather user feedback on checklist clarity and scoring consistency; refine prompts and add sector-specific examples as needed.
• Calculator Outputs: Compare results with manual spreadsheet replications during pilot debriefs to confirm formula accuracy.

​

12. References

• ISO 31000:2018 – Risk Management Guidelines.
• Ramsey, F. P. (1928). A Mathematical Theory of Saving. Economic Journal, 38(152).
• Stern Review (2006). The Economics of Climate Change. HM Treasury.
• Hubbard, D. (2009). The Failure of Risk Management. Wiley.
• Taleb, N. (2007). The Black Swan. Random House.
• GISF (2025). Call for Proposals: Development of an ROI Tool for NGO Security Risk Management.
• Humanitarian Outcomes (2023). Aid Worker Security Report.
• CDA Collaborative Learning Projects (2022). Community Engagement for Security Access.
• ALNAP (2021). Security Risk Management in Practice.
• Nicholls, J., Lawlor, E., Neitzert, E., & Goodspeed, T. (2012). A Guide to Social Return on Investment. Social Value UK.
• OECD (2019). Better Criteria for Better Evaluation: Revised Evaluation Criteria Definitions and Principles for Use. OECD Publishing.

​

Document Control

• ✅ Technical Lead – Formula accuracy verified
• ⏳ Product Owner – RFQ Stage 1 requirements fulfilled (pending review)
• ⏳ GISF Stakeholder – Methodological transparency confirmed (pending review)