The short answer: Calculate the financial loss from IT downtime using irrecoverably lost contribution margin, exceptional recovery costs, and other demonstrable impacts. Report the value of unused labour capacity separately and add it only when it does not represent the same halted process or lost business. Calculate the result separately for specific teams and scenarios.
An hour of downtime does not cost every business the same
An hour without email may merely slow some employees down. An hour without an ordering system, accounting software, production data, or access to jobs may bring both dispatch and invoicing to a halt.
The duration of the outage alone is therefore not enough. What matters is:
- how many people and processes were affected;
- how much of their work actually stopped;
- whether the work or orders can be caught up later;
- how much it costs to restore operations;
- whether the outage caused contractual penalties, spoiled materials, or the loss of a customer.
The cause does not have to be a server failure. Operations may be halted by failed authentication, a DNS error, an internet outage, damaged network equipment, an unavailable cloud service, or a security incident. In the event of an attack, recovery does not end when the computers are switched back on. The company must examine accounts, access rights, devices, and the extent of the incident.
The aim of the calculation is not to produce the highest possible figure. It should reveal which dependency poses the greatest threat to the business and where reducing recovery time is worth the investment.
Divide the impact into four categories
For a practical calculation, separate unused labour, business losses, recovery costs, and other direct impacts.
| Category | What it includes |
|---|---|
| Unused labour capacity | Paid time of people who could not perform their normal work |
| Business loss | Margin from orders or jobs that will not return |
| Service recovery | External support, overtime, replacement equipment, and other exceptional expenses |
| Other direct impacts | Penalties, compensation, spoiled materials, or repeated production |
An employee’s wages during an outage are not always a new cash expense. The company will generally pay them regardless of the incident. In the calculation, wages therefore represent the value of capacity the company could not use, not automatically an accounting loss.
Likewise, not all revenue generated during the outage period should be treated as lost. If the customer completes the order later, the impact is primarily a delay and possibly additional work. It becomes an irrecoverable loss only when the customer cancels the order or places it elsewhere.
The basic formula for calculating loss
The financial impact can be expressed as follows:
Financial loss =
irrecoverably lost contribution margin
+ exceptional recovery costs
+ other direct financial impactsReport the value of unused labour capacity alongside the financial loss as a separate management figure:
Number of affected people
× duration of disruption in hours
× total hourly employment cost
× proportion of productivity lostAdd the two amounts together only if they demonstrably represent independent impacts. If unused capacity relates to the same halted process and the same lost business as the lost margin, automatically adding them together could count the same economic harm twice.
The total hourly employment cost is not limited to gross wages. Depending on its internal methodology, a company may also include mandatory contributions and recurring personnel costs. Use payroll data for an accurate accounting calculation.
The proportion of lost productivity will vary between teams. A salesperson without CRM access may still make calls or prepare a quotation outside the system. A dispatch team without access to orders may be unable to work at all. Using a single average for the entire company therefore distorts the result.
Replace lost revenue with lost margin
When calculating the commercial impact, first distinguish between orders that were merely delayed and those that the company actually lost.
An indicative calculation may look like this:
Average hourly revenue of the affected process
× duration of disruption
× proportion of the process unavailable
× proportion of business irrecoverably lost
× contribution marginContribution margin reflects the fact that some variable costs are not incurred when an order is not fulfilled. Using the full revenue figure would therefore usually overstate the loss.
Be careful to avoid double counting. Do not automatically add the value of unused capacity to the margin lost from the same process. If an in-house administrator worked on repairing the network during the outage and their time is already included in unused labour capacity, do not add the same hour again as a separate recovery cost. Include items such as overtime, external support, or replacement equipment hire separately.
Sample calculation using hypothetical figures
The following figures merely demonstrate the method. They do not represent a typical cost of downtime or recommended values for another business.
The hypothetical company enters:
- eight affected employees;
- an outage lasting one hour;
- a total hourly employment cost of CZK 420;
- an average productivity loss of 75 percent.
The value of unused labour capacity is:
8 × 1 × 420 × 0.75 = CZK 2,520In this hypothetical example, the affected process generates average hourly revenue of CZK 10,000. Sixty percent of the process was unavailable, 30 percent of the business did not return, and the contribution margin was 40 percent:
10,000 × 1 × 0.60 × 0.30 × 0.40 = CZK 720If the company pays CZK 1,680 for recovery work outside its normal payroll costs and a further CZK 2,600 for a one-off solution, the financial impact is:
720 + 1,680 + 2,600 = CZK 5,000The result should therefore be presented from two perspectives:
Financial loss: CZK 5,000
Value of unused labour capacity: CZK 2,520The amounts in this example are not added together because the unused capacity may relate to the same halted process that caused the lost margin. A total of CZK 7,520 would be justified only if the company could demonstrate that these were independent impacts.
These figures are not a general price for one hour of IT downtime. They apply only to the stated inputs. In another company, the decisive factor may be the morning dispatch window, a payroll deadline, or the final hour for submitting a bid.
Calculate indirect impacts as scenarios
Damage to customer relationships or a company’s reputation cannot reliably be valued using a single universal percentage. Instead of one precise figure, create several scenarios.
Margin from customer relationships or jobs at risk
× estimated increase in the probability of losing themFor example, you can use:
- a conservative scenario in which customers do not notice the outage;
- a baseline scenario in which some customers have to wait or repeat their communication;
- a severe scenario in which the company misses a deadline, fails repeatedly, or deals with a data breach.
If you do not have your own data for the probability estimate, state a range and the underlying assumptions. Do not present an estimate of reputational impact as a precisely measured loss.
Find dependencies that can bring down multiple systems
The greatest risk is often not the most expensive device, but a service on which several other parts of the business depend.
Authentication and identity management
Unavailable authentication or incorrectly configured multi-factor authentication can simultaneously lock employees out of email, documents, and business applications. The company needs emergency administrator accounts, securely stored recovery details, and a procedure for verifying a user’s identity.
Internet connectivity and network equipment
A single internet connection with no backup route can bring cloud applications, telephony, and remote working to a halt. The first steps are summarised in the emergency checklist for a business internet outage.
DNS and the company domain
A DNS error or a problem at the registrar can affect the website, email, and authentication for some services at the same time. Access details for the registrar should therefore not be stored solely in a mailbox that uses the same domain.
Shared data and backups
Synchronisation is not a backup. A deleted or encrypted file may propagate to other connected devices. A backup is also of no help if the administrator cannot access it during an incident or the company has never tested the restoration process. The backup restoration test and its documentation describe a practical procedure.
A single administrator with the necessary access
The absence of one person can extend recovery more than the technical fault itself. Critical access details, supplier contacts, licences, and procedures must be handed over and remain securely available to a designated deputy.
What a business calculator should include
A useful calculator should not be pre-filled with a „typical cost of downtime." It must use data from the specific company.
Inputs should include:
- the number of people in each team;
- the duration of a complete outage or partial disruption;
- total hourly employment costs;
- the productivity decline for each team;
- the revenue and margin of the affected process;
- the proportion of business that cannot be recovered later;
- external support, overtime, and temporary solutions;
- penalties, compensation, and spoiled materials;
- the value of customer relationships at risk;
- lower and upper estimates of indirect impact.
The output should separate financial loss, the value of unused labour capacity, and the indirect-impact scenario. If the calculator provides a combined total, it must warn the user about possible overlap and allow only demonstrably independent items to be added together. It should also show which inputs have the greatest effect on the result. Alongside an ordinary failure, it is worth modelling a connection outage, unavailable authentication, server loss, and a security incident.
The status of critical services can be tracked through IT infrastructure monitoring. However, every alert must have a specific recipient, an escalation procedure, and verified contact details for someone capable of responding.
Turn the calculation into a decision
Annual risk cannot be calculated simply by multiplying the cost of one outage by twelve. For recurring events such as internet outages, use the expected annual frequency:
Expected annual loss =
sum of (expected number of events per year × average impact of one event)Multiply the probability of a scenario by its impact only when that scenario can occur no more than once during the period under review:
Expected annual loss from a one-off scenario =
annual probability of the scenario × impact of the scenarioAlternatively, use a probability and an impact figure that already represents the total impact of all occurrences over the entire year. This must, however, be stated explicitly in the input. For recurring events, the probability of at least one occurrence cannot simply be multiplied by the impact of a single event because this would fail to account for further possible occurrences during the year.
Do not add overlapping events without adjustment. An internet outage during a security incident may be part of a single scenario rather than two independent losses.
Then compare the current situation with a specific measure:
- how much a backup connection would reduce downtime;
- how quickly monitoring would detect a failure;
- whether data can be restored within the required time;
- who will take over the incident outside working hours;
- whether emergency accounts are separate from normal authentication;
- how much the measure costs compared with the reduction in expected loss.
For a security incident, also account for device isolation, changes to access credentials, and verification of the extent of the compromise. The ransomware incident plan describes the practical sequence of steps for the first 24 hours of a ransomware incident.
If you need to map dependencies, recovery times, and the costs of individual scenarios, ITHOPE can review them as part of its business IT management service. You can send the background information and scope through a no-obligation enquiry.
Frequently asked questions
Should the full wages of employees be included in the loss?
Not automatically. Regular wages are generally not a new financial expense caused by the incident. To calculate unused capacity, use the total hourly employment cost and multiply it by the actual productivity loss. Report this figure separately and add it to the lost margin only when the two items represent independent impacts.
Should a company include all revenue generated during the outage period?
No. Separate delayed orders from business that will not return. For irrecoverably lost business, calculate the contribution margin rather than automatically using the full revenue figure.
How can damage to the company’s reputation be quantified?
Create several scenarios based on the value of the relationships at risk and the possible change in the probability of losing them. Without your own data, provide a range rather than a seemingly precise amount.
What if the outage affects only one department?
Calculate each team separately. Account for the number of people, the duration of the disruption, the actual decline in productivity, and dependencies on other processes.
Which metric matters most for risk management?
Alongside the financial impact, track the verified recovery time of the most critical process. Only a practical test will show whether backups, access rights, documentation, and assigned responsibilities also work during a real outage.
Where to find us
ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.
Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).