Quantitative Risk Assessment: SLE, ARO and ALE Worked Through

Quantitative risk assessment attaches monetary values to risk so that control spending can be compared against expected loss. The formulas are simple, they appear on the exam as calculations, and knowing where their inputs come from matters as much as the arithmetic.

The formulas

Asset Value (AV) — what the asset is worth, including replacement, lost revenue during unavailability, and the cost of consequences such as notification and regulatory penalty.

Exposure Factor (EF) — the proportion of the asset's value lost in a single occurrence, expressed as a percentage. A fire destroying a building outright is 100 percent; a disk failure in a redundant array may be 5 percent.

Single Loss Expectancy (SLE) = AV × EF — the cost of one occurrence.

Annualized Rate of Occurrence (ARO) — how many times per year it is expected. Once every four years is 0.25; three times a year is 3.

Annualized Loss Expectancy (ALE) = SLE × ARO — the expected annual cost of this risk.

A worked example

A customer database is valued at £800,000 once replacement, downtime and notification costs are included. A ransomware incident is assessed as destroying availability and causing disclosure, with an exposure factor of 60 percent.

SLE = 800,000 × 0.60 = £480,000.

Based on sector incident data and the organization's own history, the event is expected once every five years, so ARO = 0.2.

ALE = 480,000 × 0.2 = £96,000 per year.

Now a control is proposed: immutable backups with tested restores, costing £30,000 a year. It is assessed to reduce the exposure factor to 20 percent, because data is recoverable even though disclosure still occurs.

New SLE = 800,000 × 0.20 = £160,000. New ALE = 160,000 × 0.2 = £32,000.

The control reduces expected annual loss by £96,000 − £32,000 = £64,000, at a cost of £30,000. Net benefit £34,000 a year, so it is justified.

That subtraction — ALE before minus ALE after, compared against annual control cost — is the calculation exam questions ask for, and the answer is frequently that a proposed control costs more than it saves.

Where the numbers come from, and where they mislead

Being honest about this is the difference between using the method well and generating false confidence.

ARO is the weakest input. For events that happen frequently — laptop theft, disk failure — there is data. For events that have never happened to you, the figure is an estimate, and a small change in it moves the result proportionally. Two analysts will produce ALEs differing by a factor of three from the same scenario.

Asset value is harder than it looks. Reputational damage, customer loss and regulatory penalty are real costs and difficult to quantify, and omitting them because they are hard understates the risk systematically.

Exposure factor assumes a single typical outcome, where real incidents have a wide distribution. A ransomware event might cost a hundred thousand or ten million depending on how far it spread.

It ignores tail risk. A risk with a low ALE made up of a tiny probability and a catastrophic loss deserves different treatment from the same ALE made of frequent small losses, because the second is survivable and the first may not be. Expected value alone does not capture that, and it is the most important limitation.

The precision of a number like £96,000 conceals all of this, and decision-makers treat precise figures as reliable ones.

When to use it

Quantitative assessment is worth the effort where a real spending decision is being made and the inputs are defensible — comparing two controls, justifying a budget, deciding on insurance cover.

For general prioritisation across a portfolio, qualitative rating is faster and no less accurate given the input uncertainty, which is why most risk registers are qualitative with a handful of quantified entries.

The hybrid position most organizations reach: qualitative ratings throughout, quantitative analysis for the few risks where the number will change a decision, and ranges rather than point estimates where the uncertainty is large.

Whatever the method, the output is compared against the organization's stated tolerance — the framework under risk appetite — and the treatment chosen accordingly. The calculation informs the decision; it does not make it.

Exam angles

Know SLE = AV × EF, ALE = SLE × ARO, and be able to compute each from a scenario and compare ALE reduction against annual control cost. Know exposure factor as the proportion of value lost per occurrence and ARO as occurrences per year, including fractional values. Recognize ARO estimation and intangible asset value as the weak inputs, and that expected-value reasoning understates catastrophic low-probability events.