Objective 5.2: Explain elements of the risk management process
Security+ SY0-701 practice question
A warehouse holds $400,000 of inventory. A risk analyst estimates that a flood would destroy 25% of that inventory and that such a flood is expected once every 20 years. A vendor offers a flood barrier system that costs $12,000 per year. Which statement is correct?
- The ALE is $100,000, so the barrier is easily cost-justified
$100,000 is the SLE, the loss from one flood. It has not been multiplied by the ARO of 0.05, so it overstates the yearly expected loss twentyfold.
- The ALE is $20,000, so the barrier saves $8,000 per year
$20,000 multiplies the full $400,000 by the ARO and skips the 25% exposure factor. Only a quarter of the inventory is expected to be lost in a flood.
- The ALE is $5,000, so the barrier is not cost-justified on these figures(Correct)
Correct. SLE = $400,000 x 0.25 = $100,000, ARO = 1/20 = 0.05, and ALE = $100,000 x 0.05 = $5,000. Spending $12,000 a year to prevent an expected $5,000 a year of loss is not cost-justified.
- The ALE is $2,000,000, so the risk should be avoided by relocating the warehouse
$2,000,000 multiplies the SLE by 20 instead of by 1/20; the ARO is the yearly frequency, not the number of years between events. Relocating the warehouse is also out of proportion to a $5,000 ALE.
Explanation
Quantitative risk analysis uses three steps. Single loss expectancy (SLE) = asset value x exposure factor = $400,000 x 0.25 = $100,000. Annualized rate of occurrence (ARO) = 1 event / 20 years = 0.05. Annualized loss expectancy (ALE) = SLE x ARO = $100,000 x 0.05 = $5,000. A control that costs more per year than the ALE it reduces is not cost-justified on these numbers alone, so accepting or transferring the risk (for example with flood insurance) may be more appropriate.