CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentEasy
A global e-commerce company is evaluating the risk of a major data breach involving customer credit card information. The risk manager has estimated the Single Loss Expectancy (SLE) for such an event to be $5,000,000. Based on industry benchmarks and internal security assessments, they anticipate that a major data breach is likely to occur once every five years. What is the Annualized Loss Expectancy (ALE) for this risk?
- A$2,500,000
- B$1,000,000
- C$25,000,000
- D$5,000,000
Show answer & explanationAnswer & explanation
Correct answer: B. $1,000,000
The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). In this case, SLE is $5,000,000 and ARO is 1 occurrence every 5 years, or 1/5 = 0.2. Therefore, ALE = $5,000,000 * 0.2 = $1,000,000.
Why the other options are wrong
- A. This would be SLE multiplied by 0.5, which is an incorrect ARO for 'once every five years'.
- C. This would be SLE multiplied by 5, which is an incorrect calculation for ARO. ARO is the number of occurrences per year.
- D. This is the SLE, not the ALE. It represents the loss from a single event, not the annual expected loss.
Annualized Loss Expectancy (ALE)
The estimated financial loss from a specific risk over a one-year period.
- Calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO).
- Used in quantitative risk analysis.
- Helps prioritize risks based on financial impact.
Memory trick: ALE: Annual Loss Expected, calculated by SLE and ARO.