Learning From the True Cost of Major Incidents

The true cost of a major incident goes well beyond the technical repair. It includes lost transactions, lost productivity, recovery effort, customer compensation, regulatory exposure, reputational damage and strategic work that gets delayed, and understanding that full cost helps organisations prioritise resilience.

• Define cost categories in advance. Agreeing what will be counted before an incident happens, with clear ownership and review points, makes later estimates consistent and comparable.
• Capture business impact during the event. Recording impact while the incident is live, rather than reconstructing it afterwards, gives a more complete picture. The article's example shows a review in which lost staff time and customer compensation far exceeded the visible infrastructure repair cost.
• Estimate ranges transparently. Avoid false precision; state assumptions openly and present ranges rather than a single misleading figure.
• Use cost evidence to prioritise resilience. Cost data should inform resilience investment decisions, tracked alongside impact estimate completeness and the cost of repeat major incidents.
• Avoid common pitfalls. Counting only technical labour understates impact, and turning cost estimates into blame undermines learning. Pilot the approach on one representative case, baseline impact estimate completeness and agree who can act if results move the wrong way.