Controls such as policies and procedures play a key role in mitigating organisational risk. They should give staff a clear sense of direction, ensure systems work, detect problems and enable them to be properly dealt with. It is also important that they are documented and regularly evaluated.

One way to evaluate the value of additional controls is to calculate the ‘Return on Control’.


In the case of the Tatton Hill Academy, the average expected direct costs of recruiting permanent teachers can be calculated by using a Monte Carlo simulation. By implementing a new HR strategy, a lower set of costs can be simulated because it would reduce the likelihood and/or impact of the risk. The difference between the two losses is the ‘Reduction in Expected Losses’.

If we assumed that the new HR strategy reduced the expected costs by £7,000 and cost £2,000 to implement. The return on control is 2.5 i.e. the expected costs were reduced by 2.5 times the cost of the additional controls.

If the reduction in expected losses were exactly the same as the cost of the control, the Return on Control would be 0, which would suggest the new control is not delivering any benefit to the organisation.