Putting a Price Tag on Failure
In finance, Value at Risk (VaR) is a metric that answers: "What is the most money I could expect to lose in a single bad day (or week, or year) with a given confidence level?"
In engineering, we adapt this concept to quantify the potential cost of incidents. The power of VaR is translation — it converts abstract technical risks ("our failover is untested") into business language ("we are carrying $40,000 of unmitigated exposure"). Executives do not intuitively understand MTTR (Mean Time To Recovery), but they understand dollars at risk.
Example: Calculating Engineering VaR for a Database Outage
Let's calculate the VaR for your main e-commerce database going down.
- Revenue per hour: Your site generates $10,000 per hour in transactions.
- Worst-case outage duration: Based on your last recovery drill — or your best estimate if you have never run one — it takes 4 hours to restore from a backup and verify data integrity.
- Additional costs: Customer support surge ($2,000), SLA penalty credits ($3,000), engineering overtime ($1,500).
- Reputational cost estimate: 5% customer churn on affected users, estimated at $5,000 in lifetime value.
Engineering VaR for this scenario:
Direct revenue loss: $10,000/hr × 4 hrs = $40,000
Support + SLA + overtime: = $6,500
Estimated reputation loss: = $5,000
─────────────────────────────────────────────────────
Total VaR: = $51,500
Now you have a concrete number. If someone proposes spending $15,000 on a hot standby replica with automated failover that reduces recovery time from 4 hours to 5 minutes, the business case writes itself:
- Cost of mitigation: $15,000/year
- Risk reduction: VaR drops from $51,500 to ~$2,800 (5 minutes of revenue loss plus minimal support impact)
- Net risk reduction: $48,700
This is how you get budget for reliability work. You are not asking for money to "make things better" — you are showing that a $15,000 investment eliminates $48,700 of exposure.
Annualized Loss Expectancy (ALE) takes VaR one step further by factoring in likelihood.
VaR alone tells you "if this outage happens, it costs $51,500." But it doesn't tell you whether to invest in mitigation today, because a $51,500 outage that happens once a decade is a very different problem from one that happens monthly. ALE answers that by averaging the cost across the probability of occurrence — turning a one-time worst-case figure into a yearly budget number you can compare against the cost of mitigation.
ALE = VaR × Annual Probability of Occurrence
If there is a 10% chance of this database outage per year:
ALE = $51,500 × 0.10 = $5,150/year
This tells you: on average, this risk costs the business $5,150 per year. Any mitigation costing less than $5,150 per year is a net positive investment — even though the outage itself, if it occurs, would cost $51,500.
VaR vs. ALE in one line: VaR = the price tag on a single bad day. ALE = the yearly cost if you spread that bad day's expense across the likelihood it actually happens. Use VaR to size the failure; use ALE to budget against it.
Key Point: VaR calculations are estimates, not predictions. The value is not in the precision of the number — it is in the process of thinking through failure scenarios end-to-end and making costs explicit. Even a rough VaR estimate is infinitely more useful than "we should probably fix that someday."