CISM Information Security Risk Management Practice Question
A healthcare organization's risk register shows a critical patient-records system with an annualized loss expectancy (ALE) of $2,400,000. A proposed control costs $300,000 per year and is estimated to reduce the ALE to $400,000. The CISO must present the strongest financial justification to the executive committee. Which of the following is the MOST appropriate metric to present?
⚠ Common exam trap
The trap here is assuming that presenting residual risk or qualitative likelihood and impact ratings is sufficient justification, when executives approving a specific annual spend need the quantified cost-benefit comparison.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A cost-benefit analysis showing a net benefit of $1,700,000 per year from the control.
Cost-benefit analysis translates the risk reduction into a monetary figure that decision-makers can weigh against the control's annual cost. Here the control lowers expected annual loss by $2,000,000 while costing $300,000, producing a $1,700,000 net benefit. This quantitative justification is far more persuasive to an executive committee than residual risk, asset value, or qualitative ratings alone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A cost-benefit analysis showing a net benefit of $1,700,000 per year from the control.
Why this is correct
Subtracting the $300,000 annual control cost from the $2,000,000 in loss reduction ($2,400,000 ALE minus $400,000 residual ALE) yields a net benefit of $1,700,000 per year. This cost-benefit figure directly demonstrates that the investment produces a positive return, which is the clearest financial justification for the executive committee.
- ✗
The residual risk of $400,000 after the control is implemented.
Why it's wrong here
Residual risk describes the exposure that remains once the control is in place, but it does not express the financial return of the investment. Presenting only the leftover exposure leaves the committee unable to compare the $300,000 annual spend against the $2,000,000 in losses avoided, which is the comparison executives need to approve funding for the patient-records system.
- ✗
The control's annualized cost of $300,000 compared with the total asset value of the patient-records system.
Why it's wrong here
Comparing control cost to asset value is not a standard risk-finance metric and produces a misleading ratio, because asset value does not represent expected annual loss. The committee needs a figure tied to loss expectancy, not to the replacement or book value of the patient-records system, to judge whether the $300,000 spend is justified.
- ✗
The likelihood and impact ratings of the threat before and after the control.
Why it's wrong here
Qualitative likelihood and impact ratings are useful for prioritizing risks, but they do not quantify the monetary value of the control. The executive committee is being asked to approve a $300,000 annual expenditure, so a qualitative comparison alone cannot show whether the spend is financially worthwhile for the patient-records system.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.