RemoteIT risk
How much IT risk is acceptable? That's the owner's call, not IT's.
IT can show you the threats, the controls and what each option costs. Deciding how much risk to accept is a business decision, and it should be made in dollars and written down. Here is how, with a calculator to put one risk in front of your board.
Cost data from ASD's Annual Cyber Threat Report 2024-25. Checked 31 October 2026.
- Who decides
- Risk in dollars
- Expected-loss calculator
Reviewed by Blake Bath, General Manager, on 31 October 2026.
Roles
Four steps, two owners.
IT informs the decision. The business makes it.
IT maps the threats
What could happen, which controls exist, where the gaps are.
- Assessment
- Gaps listed
- Evidence
IT prices the options
What changes if you spend this, or that.
- Options
- Costs
- Residual risk
The owner decides
Accept, reduce or insure each risk, in writing.
- Minutes
- Named owner
- Dated
Review it
Quarterly, and after any major change.
- Trend tracked
- Register updated
- Decisions revisited
Expected annual loss calculator
Put one risk in dollars for the board.
Pick the cost, how often it might happen, how much a control reduces it, and what the control costs. You get the expected annual loss before and after.
Put a dollar figure on one risk for the board. Expected annual loss is the cost of an incident times how often you expect one. The default cost is ASD's average; use your own if you have it.
Expected annual loss
A$11,320
falls to A$5,660 with the control: a reduction of A$5,660 a year against a cost of A$5,000.
The control pays for itself on expected loss (+A$660 a year).
Based on ASD's 2024-25 average self-reported cost per cybercrime report for this size of business. Expected loss is a planning figure, not a forecast. A single incident can cost far more than the average.
For the board
Framing IT risk so a board can decide.
- Dollars, not jargonWhat an incident would cost and how likely it is, not which control is missing.
- Expected annual lossCost per incident times how often you expect one. A rough estimate beats a feeling.
- Three optionsAccept, reduce with controls, or transfer to insurance, each with a cost.
- The same scale as other risksCompare IT risk with the financial and legal risks the board already manages.
What incidents cost
What we know about cost and cause.
| Measure | Figure | Source |
|---|---|---|
| Average cost per cybercrime report, small business | A$56,600 | ASD Annual Cyber Threat Report 2024-25 |
| Average cost, medium business | A$97,200 | ASD 2024-25 |
| Average cost, large organisation | A$202,700 | ASD 2024-25 |
| Share of cyber insurance claims from email and funds transfer fraud | 60% | Coalition 2025 Cyber Claims Report (2024 claims) |
Averages are self-reported and hide wide ranges. Use them to start the conversation, then replace them with your own estimates.
Essential Eight
Use the Essential Eight as the common yardstick.
- A grade others understandInsurers, customers and auditors recognise maturity levels.
- Level Two for mostASD's model suggests most organisations target Maturity Level Two.
- All eight countA level only counts when every strategy meets it.
- Check outside expectationsYour insurer, contracts or regulator may set their own bar.
What goes wrong
Common risk management mistakes.
- Treating it as an IT problemWithout owner sign-off, spending follows noise, not priority.
- No written toleranceEvery investment becomes a debate.
- No registerRisks drift and controls lapse unnoticed.
- Verbal acceptanceIf it isn't written down, it wasn't decided.
- Insurance as the planCover helps with cost. It doesn't stop the incident.
Our view
Start with the risks that cost money most often.
For most small businesses, the risk that turns up most often is email fraud, not a sophisticated attack. Phone checks on bank changes, phishing-resistant MFA and mailbox monitoring are cheap, and they come out well in any expected-loss comparison.
We build a one-page register with the owner: each risk in dollars, the decision made, who owns it and when it's next reviewed. It doubles as the evidence your insurer asks for.
How we work
An IT risk assessment in five steps.
- Step 1Assess
Controls against the Essential Eight.
- Step 2Price
Likelihood and cost for each risk.
- Step 3Decide
Owner accepts, reduces or insures, in writing.
- Step 4Act
Treatment plan with costs and owners.
- Step 5Review
Quarterly, with the trend.
Related guides
Risk in practice. Insurance, controls and roadmap.
Turning decisions into action.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about IT risk.
Who decides how much IT risk is acceptable?
The board or owner. IT and your provider map the threats, the controls and what each option costs. The business decides what to accept, reduce or insure, and records that decision.
How do we put IT risk in dollars?
Estimate the cost of an incident and how often it might happen. Multiply them to get an expected annual loss, then compare that with what a control costs and how much it reduces the risk. Rough numbers beat no numbers.
What does a cyber incident cost an Australian business?
In ASD's Annual Cyber Threat Report 2024-25, the average self-reported cost per cybercrime report was A$56,600 for small businesses, A$97,200 for medium businesses and A$202,700 for large organisations. Single incidents can cost far more.
Which Essential Eight level should we aim for?
Most organisations should target Maturity Level Two, and a level only counts when all eight strategies meet it. Your insurer, customers or regulator may set their own expectations, so check them.
What is a risk register?
A list of your risks, how likely and costly each is, the controls in place, the decision made and who owns it. A spreadsheet is enough to start. It also becomes the evidence your insurer asks for.
How often should IT risk be reviewed?
Quarterly is a good rhythm for most businesses, and after any major change: a new system, a new supplier, an incident or a key person leaving.
Next step
Want a risk register your board can actually use?
We assess your controls, price the main risks with you, record the decisions and review them each quarter.
Keep reading
Reviewed by Blake Bath, General Manager, on 31 October 2026. Cost data from ASD; claims data from Coalition. Checked 31 October 2026. ASD, Annual Cyber Threat Report 2024-25 factsheet for businesses; Cyber Daily, Annual Cyber Threat Report 2024-25 by the numbers; Coalition, 2025 Cyber Claims Report; ASD, Essential Eight maturity model