“risk managers” spend a lot of time imagining they can determine “annualized loss expectancy” by predicting how much an incident will cost. Think about all the factors to consider before wasting time imagining costs of future incidents. I think what you will find is that this can be a really difficult exercise. However, if you can derive some general guidelines, it’s worth it. It’s worth the exercise. Think about answering these questions for a really good recent interest before asking them to think about what else can you imagine?”]
Source: https://taosecurity.blogspot.com/2010/05/forget-pre-incident-cost-how-much-did.html