Sign in

Blog · Board and management reporting

Power BI risk management dashboard: exposure by business unit

A business risk dashboard compares quantified exposures, accountable owners and changes in assumptions. Work through a US distributor's risk register, reconcile expected loss by unit and see how one changed probability moves the result.

The short answerA Power BI risk management dashboard summarizes business exposures by unit, event, owner and reporting date. A useful financial view separates the loss if an event occurs from its probability-weighted expected loss. Start with a dated risk register, use consistent time horizons and reconcile unit totals to individual risk records before using the summary to allocate management attention.

A Power BI risk management dashboard should show which business units carry exposure, how that exposure was estimated and who owns the response. The useful starting point is a dated risk register with distinct events, comparable loss estimates and a common assessment horizon. A colored summary becomes useful only when its totals can be rebuilt from those records.

Define the business question before the display

For the example below, the management question is: which unit contributes more to estimated financial exposure over the coming year? That is narrower than asking which event would be most damaging, which control is weakest or which issue requires immediate escalation. Those questions deserve separate views.

Microsoft defines a Power BI dashboard as a single page of highlights, with related reports providing detail. Use that distinction to keep the summary focused: expected loss by unit, major individual events, changed assumptions and accountable owners. Put the underlying register beside the review materials so the audience can inspect the inputs.

The broader risk management dashboard covers the general reporting question; this example concentrates on reconciling quantified business exposure. Covirage is not affiliated with Microsoft Power BI.

Start with a register that can be compared

Juniper Industrial Supply is an illustrative US distributor reviewing its East and West business units on September 30, 2026. Each event has an estimated probability of occurring during the following year and a loss amount conditional on that event occurring. The estimates below represent exposure after existing controls, with no additional insurance recovery assumed.

The register needs an event ID, unit, event description, owner, assessment date, horizon, probability and loss basis. Add a note explaining the evidence behind each estimate. A customer default estimate and a supplier interruption estimate can share a reporting table, but their assumptions must remain visible.

NIST's risk glossary describes risk in terms of adverse impact and likelihood. The simple financial convention used here turns those two inputs into an expected loss:

Expected loss for an event = Probability of occurrence × Loss if the event occurs

Unit expected loss = Sum of expected losses for that unit's distinct events

This example treats each event as occurring at most once during the horizon and uses one conditional loss estimate. A recurring disruption or a range of possible severities needs a richer assessment. The calculation is a management estimate, not a prediction of the amount the company will lose.

A worked register for the review

All amounts are USD. Percentages in the input column are assumptions, and dollar results are shown to the nearest whole dollar.

Event ID Unit Event Probability Conditional loss (USD) Expected loss (USD)
R101 East Major customer default 10% 400,000 40,000
R102 East Delivery interruption 20% 150,000 30,000
R201 West Supplier outage 25% 240,000 60,000
R202 West Product recall 5% 600,000 30,000
Register total 1,390,000 160,000

For R201, the calculation is 25% × $240,000 = $60,000. For R202, it is 5% × $600,000 = $30,000. The recall has the largest conditional loss, although its expected loss is lower than the supplier outage's.

Do not average the probability column to create a company probability. The events concern different outcomes, and their probabilities do not describe one shared company event. Likewise, the conditional-loss total is a sum of listed amounts; it is not an estimate of the company's worst possible combined loss.

Reconcile the summary to the events

The first display should preserve the distinction between impact and expected loss.

Business unit Included event IDs Conditional losses summed (USD) Expected losses summed (USD)
East R101, R102 550,000 70,000
West R201, R202 840,000 90,000
Total All register events 1,390,000 160,000

East reconciles as $40,000 + $30,000 = $70,000. West reconciles as $60,000 + $30,000 = $90,000. The unit summary closes at $70,000 + $90,000 = $160,000, exactly the event total.

West contributes $90,000 / $160,000 = 56.25% of expected loss. That supports a focused review of its assumptions and controls. It does not justify ignoring the East delivery interruption or treating the West recall as harmless.

In the review file, retain a control count of unique event IDs and a list of excluded records. Investigate missing units or missing probabilities separately; a blank estimate must not silently become a zero. The management reporting package should state that these are forward estimates alongside, rather than added into, historical operating results.

Change one assumption and explain the movement

Suppose a documented supplier continuity assessment changes only R201's annual probability from 25% to 15%. The conditional loss, other events and horizon stay unchanged.

Measure Original (USD) Revised (USD) Calculation
R201 expected loss 60,000 36,000 15% × 240,000
West expected loss 90,000 66,000 36,000 + 30,000
Company expected loss 160,000 136,000 70,000 + 66,000

The company estimate falls by $160,000 − $136,000 = $24,000, or $24,000 / $160,000 = 15.0%. That is a change in assessed exposure. It is not a realized saving, cash receipt or proof that a control prevented a loss.

Keep both assessment dates and the supporting rationale. Otherwise, a lower number can look like operating progress when only the estimate changed. An executive dashboard can carry the movement and owner, with the risk register supplying the evidence.

Where it goes wrong

  • Overlapping losses. An outage recorded under procurement and again under operations can duplicate the same financial harm. Use a shared event ID and document any genuinely separate components.
  • Mixed horizons. A monthly probability cannot be compared directly with an annual probability. Align the assessment horizon before totaling.
  • Mixed exposure bases. Loss before controls, loss after controls and loss after recoveries answer different questions. Label the basis and compare like with like.
  • Expected loss treated as a limit on harm. A low expected value can sit beside a severe conditional loss. Keep severity visible and review it separately.
  • Unsupported precision. An exact calculation does not make an estimated probability exact. Show the estimate's owner, evidence and assessment date.

The wider Power BI dashboard examples help place this focused exposure view within a broader business review without expanding it into an all-purpose scorecard.

Compare your own exposure register in Covirage

Bring a sample of your own risk register as a file or Google Sheet, including event IDs, units, probabilities, loss amounts and assessment dates. Covirage maps the columns, and its tools compute and check the figures; the external AI model explains the comparison with every figure traced to its rows. Create a free Covirage account, then set up your business and bring your file.

See self-service analytics for the supporting business reporting approach.

Questions people ask

What should a business risk dashboard show?

Show the exposure amount, probability, expected loss, business unit, responsible owner and assessment date. Keep severe events visible even when their probability is low. Include the assumptions and exclusions so readers can distinguish an estimate from a recorded financial balance.

Can expected losses be added across business units?

Yes, when each row represents a distinct loss component and uses the same time horizon and currency. Avoid counting the same disruption in several departments. Adding expected losses does not establish the worst possible combined loss or describe how events might occur together.

Is a risk score the same as a dollar exposure?

No. An ordinal risk score ranks an assessment under an internal scale. A dollar exposure estimates financial harm under stated assumptions. Keep scores and monetary amounts in separate columns, and do not present the sum of ranking scores as a financial loss.