Risk managers should be able to associate cost with identified business risks. This should be included with the process costing and should be dynamically adjustable as the risk is mitigated with controls.