CAS Exam 9 · Controls and Mitigation Strategies · Tutorial 174 of 995

Worked Mitigation Choice For A Vendor Outage

Work through a vendor outage decision by calculating the cost and residual exposure under retention, controls, service-contract credits, insurance, and a combined option.

Intermediate 9 min read

What You'll Learn

Set up mutually exclusive outage scenarios and calculate baseline expected interruption loss
Distinguish a control that changes event probabilities from protection that reduces losses
Calculate service-contract credits subject to a per-event cap
Apply an insurance deductible before the policy limit to find residual losses
Compare annual expected costs while identifying differences in severe-outage exposure
Evaluate a combined control-and-insurance option without double counting costs

Framing a Vendor Outage Decision

A vendor outage can interrupt operations even when the organization has effective internal controls. A mitigation choice should therefore distinguish between measures that reduce the chance of an outage and measures that reduce the financial consequences if one occurs. Preventive controls may change outage probabilities; service-contract credits and insurance may offset some loss; retention leaves the organization responsible for the loss.

The calculations below use a hypothetical organization and hypothetical annual outage scenarios. The purpose is to compare options on a consistent basis, not to imply that a particular control, contract, or policy will perform as modeled in practice. Each option has a stated annual cost and stated effect on the scenario losses. The calculations assume those terms are enforceable and that any modeled payment is collectible.

Definition: For an option $m$, let $C_m$ be its fixed annual cost, $p_j^{(m)}$ the probability of scenario $j$ under that option, and $R_j^{(m)}$ the organization's residual loss in that scenario after applying the option. Its expected annual cost is $$ E[T_m]=C_m+\sum_j p_j^{(m)}R_j^{(m)}. $$ For retention, $C_m=0$ and residual loss is the full interruption loss. This comparison includes only the stated costs and losses; it does not assign a value to unmodeled effects such as reputational harm or management time.

The scenarios in the examples are mutually exclusive and exhaustive for one year: exactly one of no outage, a moderate outage, or a severe outage occurs. Their probabilities must sum to 1. The examples also assume at most one modeled outage per year. A model with multiple outages would need to represent their combined annual losses and any per-event contract or policy limits explicitly.

Establish the Baseline and Test a Preventive Control

Suppose the hypothetical vendor supports a claims platform. A moderate outage produces a $50,000 interruption loss and a severe outage produces a $180,000 loss. In the baseline, the annual probabilities are 0.90 for no outage, 0.07 for a moderate outage, and 0.03 for a severe outage. These probabilities sum to $0.90+0.07+0.03=1.00$.

Worked Example: Baseline Retention and a Preventive Control

Calculate the baseline expected interruption loss. Then evaluate a hypothetical annual control costing $2,400 that changes the probabilities to 0.95 for no outage, 0.04 for a moderate outage, and 0.01 for a severe outage. Assume the loss amounts conditional on an outage do not change.

Method. Multiply each scenario loss by its probability and add the results. The no-outage scenario has zero interruption loss.

Baseline under retention. The expected annual loss is $$ 0.90(0)+0.07(50{,}000)+0.03(180{,}000) =0+3{,}500+5{,}400 =\$8{,}900. $$ With no separate retention cost specified, the total expected annual cost is also $8,900.

After the control. First check the revised probabilities: $0.95+0.04+0.01=1.00$. The expected interruption loss after the control is $$ 0.95(0)+0.04(50{,}000)+0.01(180{,}000) =0+2{,}000+1{,}800 =\$3{,}800. $$ Add the $2,400 annual control cost: $$ E[T_{\text{control}}]=2{,}400+3{,}800=\$6{,}200. $$ The control reduces expected annual cost by $8{,}900-6{,}200=\$2{,}700$ relative to retention under these assumptions. It does not eliminate outage losses: if a severe outage occurs, the modeled loss remains $180,000.

Check and common mistake avoided. The control probabilities sum to 1, and the control cost is added once to the post-control expected loss. A common error is to add the control cost to the baseline loss, ignoring that the control changes the probabilities; the correct comparison uses the revised probabilities.

Calculate Contractual and Insurance Protection

A service contract may provide a credit when the vendor fails to meet specified availability terms. The credit is not necessarily equal to the organization's full interruption loss. A credit cap, a narrow trigger, notice requirements, or exclusions can all leave substantial residual exposure. For the next calculations, assume the contract terms are satisfied and the credits are collectible.

An insurance policy also leaves residual exposure. For a covered loss $L$, deductible $d$, and maximum per-event payment $u$, assume the insurer pays $$ Y=\min\bigl(\max(L-d,0),u\bigr). $$ The organization's residual loss is $L-Y$. This formula assumes the loss is covered, the deductible is applied to the loss before the payment limit, and $u$ is a cap on the insurer's payment. An exclusion or a different policy wording could produce a different result.

Worked Example: Service Credits Versus an Insurance Policy

Use the baseline probabilities and losses from the vendor scenario. A hypothetical service contract costs $1,800 per year and provides a credit equal to the loss, capped at $30,000 per outage. Alternatively, an insurance policy costs $3,100 per year, has a $10,000 deductible, and has a $100,000 per-event payment limit. Assume both protections respond to both outage scenarios. Calculate the expected annual cost and the residual loss in each outage scenario for each option.

Service contract. For a $50,000 moderate loss, the credit is $\min(50{,}000,30{,}000)=\$30{,}000$, leaving $50{,}000-30{,}000=\$20{,}000$. For a $180,000 severe loss, the credit is $\min(180{,}000,30{,}000)=\$30{,}000$, leaving $180{,}000-30{,}000=\$150{,}000$. The expected residual loss is $$ 0.07(20{,}000)+0.03(150{,}000) =1{,}400+4{,}500 =\$5{,}900. $$ Adding the $1,800 annual contract cost gives $5{,}900+1{,}800=\$7{,}700$ expected annual cost.

Insurance. For a $50,000 loss, the amount above the deductible is $50{,}000-10{,}000=\$40{,}000$. Since this is below the $100,000 payment limit, the insurer pays $40,000 and the residual is $10,000. For a $180,000 loss, the amount above the deductible is $180{,}000-10{,}000=\$170{,}000$. The payment is capped at $100,000, so the residual is $180{,}000-100{,}000=\$80{,}000$.

The expected residual loss is $$ 0.07(10{,}000)+0.03(80{,}000) =700+2{,}400 =\$3{,}100. $$ Adding the $3,100 premium gives $3{,}100+3{,}100=\$6{,}200$ expected annual cost.

Check and common mistake avoided. The service-credit residuals are $20,000 and $150,000; the insurance residuals are $10,000 and $80,000. The deductible is not itself the maximum insurer payment: for the severe loss, the payment after the deductible would be $170,000, but the policy limit reduces it to $100,000. Applying the limit to the loss before the deductible would give an incorrect result.

Deriving the Expected-Cost Comparison

The expected-cost formula follows by partitioning outcomes into the mutually exclusive scenarios. In scenario $j$, total cost is the fixed annual cost $C_m$ plus residual loss $R_j^{(m)}$. The probability-weighted average of those scenario costs is $$ E[T_m]=\sum_j p_j^{(m)}\bigl(C_m+R_j^{(m)}\bigr). $$ Because the probabilities sum to 1, the fixed cost can be taken outside the sum: $$ E[T_m]=C_m\sum_j p_j^{(m)}+\sum_j p_j^{(m)}R_j^{(m)} =C_m+\sum_j p_j^{(m)}R_j^{(m)}. $$

This justification also explains why the treatment of each option differs. A preventive control can change $p_j^{(m)}$, while a contract or policy can change $R_j^{(m)}$. A combined option can change both. To compare alternatives consistently, apply each option to the same scenario framework, include its fixed cost once, and use its own probabilities and residual losses.

Compare Standalone and Combined Options

The calculations so far give a common-basis comparison. The figures below are expected annual costs under the stated hypothetical assumptions, not forecasts of actual vendor performance.

Option	Fixed annual cost	Expected residual loss	Expected annual cost
Retain baseline risk	$0	$8,900	$8,900
Preventive control	$2,400	$3,800	$6,200
Service contract	$1,800	$5,900	$7,700
Insurance	$3,100	$3,100	$6,200
Control plus insurance	$5,500	$1,200	$6,700

Worked Example: Evaluating a Control-and-Insurance Combination

Assume the organization buys both the $2,400 control and the insurance policy from the prior example. The control changes the probabilities to 0.95, 0.04, and 0.01; the insurance policy leaves residual losses of $10,000 for a moderate outage and $80,000 for a severe outage. Calculate the combined expected annual cost and compare it with the two standalone options.

Method. Use the post-control probabilities with the post-insurance residual losses. Add both fixed costs once: $2{,}400+3{,}100=\$5{,}500$.

The expected residual loss is $$ 0.95(0)+0.04(10{,}000)+0.01(80{,}000) =0+400+800 =\$1{,}200. $$ Therefore, $$ E[T_{\text{control+insurance}}]=5{,}500+1{,}200=\$6{,}700. $$ This is $500 higher than either standalone control or standalone insurance at $6,200. However, it reduces the probability of a severe outage to 0.01 and leaves a modeled severe-outage residual of $80,000, compared with a $180,000 severe-outage loss under the control alone. The combination may therefore be relevant if the organization's tolerance for a large retained loss is important, even though its expected cost is higher.

Check and common mistake avoided. The combined calculation uses the control's revised probabilities and the policy's residual losses. It does not apply the insurance policy to the original baseline probabilities. It also adds the control cost and premium once each; subtracting an expected insurance payment from gross loss and then adding it again as a benefit would double count the transfer.

Use Expected Cost With Care

The lowest expected annual cost is not automatically the best mitigation choice. Expected cost averages the outcomes; it does not show how damaging a severe scenario would be or whether the organization can absorb it. In this example, the standalone control and insurance both have an expected annual cost of $6,200, but their effects differ. The control reduces the chance of an outage while leaving the full $180,000 severe loss if one occurs. Insurance leaves a $80,000 severe residual under the stated policy terms but does not change the modeled outage probabilities.

A decision should also check whether the assumed protection matches the actual risk. For a service contract, confirm that the outage meets the trigger, the credit calculation and cap are understood, and collection is plausible. For insurance, check the covered cause of loss, deductible, limit, exclusions, and any conditions that could prevent payment. For a control, verify that its probability reduction is supported and that it does not rely on the same failure point as another control.

A useful comparison records both the expected annual cost and the scenario-level residual loss. That makes visible the difference between reducing the likelihood of an event, reducing its severity, and paying a fixed amount to transfer part of its financial impact.

Control: model its effect through revised scenario probabilities or revised losses, as supported by the control design.
Service contract: calculate the credit under its stated trigger and cap, then subtract the collectible credit from the relevant loss.
Insurance: apply the deductible and payment limit in the order specified by the policy, and retain uncovered or above-limit amounts.
Retention: include the full modeled loss; do not treat the absence of a premium as absence of cost.

Key takeaway: Compare mitigation choices using the same scenario set, but do not reduce the decision to one expected-cost figure. State each option's fixed cost, probability changes, scenario-level residual losses, and important assumptions. A sound comparison is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus.

Check Your Understanding

Use the stated annual scenarios and assume all amounts are dollars. Each problem is hypothetical; calculate the requested expected annual cost using the specified terms.

A vendor outage has probability 0.06 of a $40,000 loss, probability 0.02 of a $120,000 loss, and otherwise no loss. Under retention, what is the expected annual loss? (Answer: $4,800.)
Using the same losses, a control costs $700 annually and changes the probabilities to 0.03 for the $40,000 loss and 0.01 for the $120,000 loss, with no outage otherwise. What is the control's total expected annual cost? (Answer: $3,100.)
Using the original probabilities, a service contract costs $900 annually and provides a credit equal to the loss up to $20,000 per outage. What is the total expected annual cost after credits? (Answer: $4,100.)
Using the original probabilities, an insurance policy costs $2,000 annually, has a $5,000 deductible, and pays at most $50,000 per event. Assuming both losses are covered, what is the total expected annual cost? (Answer: $3,700.)
Combine the control in Question 2 with the insurance policy in Question 4. What is the combined expected annual cost? (Answer: $3,550.)

Back to Tutorials