ALE = SLE * AROwhere SLE is the Single Loss Expectancy and ARO is the Annualized Rate of Occurrence.
An important feature of the Annualized Loss Expectancy is that it can be used directly in a cost-benefit analysis. If a threat or risk has an ALE of $5,000, then it may not be worth spending $10,000 per year on a security measure which will eliminate it.
One thing to remember when using the ALE value is that, when the Annualized Rate of Occurrance is of the order of one loss per year, there can be considerable variance in the actual loss. For example, suppose the ARO is 0.5 and the SLE is $10,000. The Annualized Loss Expectancy is then $5,000, a figure we may be comfortable with. Using the Poisson Distribution we can calculate the probability of a specific number of losses occurring in a given year:
|Number of Losses|
We can see from this table that the probability of a loss of $20,000 is 0.0758, and that the probability of losses being $30,000 or more is approximately 0.0144. Depending upon our tolerance to risk and our organization's ability to withstand higher value losses, we may consider that a security measure which costs $10,000 per year to implement is worthwhile, even though it is more than the expected losses due to the threat.
You're welcome to use these definitions for any purpose provided that an acknowledgement is made to www.riskythinking.com and (if you're using HTML) you provide a link back to this site.
Risky Thinking Newsletter
Are you responsible for Business Continuity, Disaster Recovery, or Risk Management in your organization? Then you may wish to receive a free subscription to the the monthly Risky Thinking Newsletter. It contains news, opinions and articles of interest to people working in these areas.
Recent articles have included:
© Albion Research Ltd. 2013