We are the designers of the XOI methodology, which is adopted by some of the world's leading financial institutions. The XOI approach (Exposure, Occurrence, Impact) decomposes the risk into 3 dimensions.
Exposure:
The number of resources exposed independently to the occurrence of an event. Exposed resources can be employees for fraud, suppliers for disruption, trades for errors, products for mis-selling, etc.
Occurrence:
This is the probability of occurrence of the considered event for one particular resource. This probability may depend on the resource itself of the firm controls and on external circumstances.
Impact:
This is the cost of the event should it occur for one particular resource. This cost is variable and depends on the resource itself, of the firm controls, and on external circumstances.