Session 13 · ERQI Global Virtual Risk Summit
Enterprise risk quantification: from individual risk domains to enterprise decision making
Lisa Wagner, James Hanbury & Jonny Mattey, moderated by David White
Overview
Three practitioners who have taken quantification beyond cyber agreed that the method travels well, and that the harder work is with people. In this session, Lisa Wagner, James Hanbury and Jonny Mattey argued for a loose definition anchored in scenarios, a start that solves someone's real problem, and a careful approach to risk appetite.
Session 13 recording, ERQI Global Virtual Risk Summit 2026
A loose definition with a clear taxonomy
Lisa Wagner was hired at Health Catalyst to build cyber risk quantification with FAIR, and her board then asked her to extend it across enterprise risks. She defines enterprise risk quantification loosely: something will go wrong, it will cost a certain amount, and that cost is reported as a dollar range. A tighter definition, she has found, invites pushback from risk category owners. Jonny Mattey, a CISO now scaling quantification across his company's wider risk portfolio, called his version a mantra more than a definition: think probabilistically and communicate that way too. James Hanbury offered a characteristic instead, a consistent way of putting very different things on the same level playing field, starting with scenarios. Mattey added a limit to the looseness. A clear taxonomy still has to sit inside the broader definition, because scenarios and a consistent method are the only way to unify disparate risk specialisms. David White first heard the looseness as a cop-out, then called it purposeful, since quantification takes effort and belongs on the categories that matter now, such as the wildfire modeling he sees among US electric utilities.
Why it spreads, and how to start
Wagner's driver was her board, and she saw how risks connect: cyber can lead to operational fallout, then market decline. Siloed qualitative reporting aggregates chaotically, and in her words, "you can't really do orange plus orange equals red." Mattey described a high-growth, PE-backed business ready to mature its risk function, with a credible cyber program behind him. Hanbury sees quantification pulled in by boardroom events that demand an objective view with assumptions that can be challenged.
On starting, Hanbury advised finding a source of pain and solving it. He described a global retailer whose cyber quantification team built a turnover model for its talent team, and the work then "grew arms and legs." Wagner started with FAIR, asked "why" wherever it seemed not to fit, and anchored on strategy: identify the five things that could stop the business from reaching it. Mattey was candid that moving from subject matter expert to methodologist, in areas such as fraud and health and safety, is uncomfortable. Loss categories, confidence ranges and control mapping transferred well. Data sources and likelihood were harder.
Risk appetite and ownership
Hanbury described risk appetite as one of the most challenging aspects of enterprise risk management outside traditional financial risk disciplines. A common middle path is a first-line judgment approved by second line and informed by quantitative results. Mattey's executives signed a qualitative appetite statement as a "North Star," while tolerances were set in quantified terms from Monte Carlo output. Wagner could not get an appetite statement, so she built a survivability model showing where the business would cease to exist. On ownership, she said owning a risk means acknowledgment and a risk response, not a mandate to mitigate.
“You can't really do orange plus orange equals red.”
Lisa Wagner, on why siloed qualitative reporting does not aggregate
Key takeaways
1
Keep the definition loose and the taxonomy clear
Scenarios give different risk domains a common basis, while a rigid definition invites resistance from category owners.
Watch at 14:012
Start with a pain point
Hanbury advised solving a real problem for a stakeholder before building a framework, and Wagner suggested modeling what could stop the strategy.
Watch at 32:053
Build relationships before the committee meets
Mattey's view was that the decision is made long before you sit in the room, so map supporters and detractors early. Hanbury added: "Sell the benefits, not the method."
Watch at 26:244
Separate appetite from tolerance
Where a quantified appetite is out of reach, a qualitative statement plus quantified tolerances, or a survivability view, can still start the conversation.
Watch at 49:31
