CISM Information Security Risk Management Practice Question
In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?
⚠ Common exam trap
The trap here is that candidates often compare the control cost to the original ALE ($10,000) or to the residual ALE ($2,500) instead of comparing it to the reduction in ALE ($7,500), leading to incorrect cost-justification conclusions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Accept the risk because the control is not cost-justified.
The ALE is calculated as SLE × ARO = $50,000 × 0.2 = $10,000. After implementing the control costing $12,000 per year, the residual ALE is $50,000 × 0.05 = $2,500. The annual cost of the control ($12,000) exceeds the reduction in ALE ($10,000 - $2,500 = $7,500), so the control is not cost-justified. Therefore, accepting the risk is the most cost-effective response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Accept the risk because the control is not cost-justified.
Why this is correct
ALE equals SLE multiplied by ARO: $50,000 × 0.2 = $10,000. The control costs $12,000 annually while reducing expected loss to $2,500, a $7,500 benefit, so it is not cost-justified. Accepting the risk is therefore the most cost-effective response.
- ✗
Accept the risk because ALE after control is only $2,500.
Why it's wrong here
Accepting ignores that the control's $12,000 annual cost exceeds the $7,500 loss reduction (from $10,000 to $2,500), so acceptance is not cost-effective. It is tempting because the residual ALE of $2,500 is genuinely low, and acceptance would be correct if the control cost less than the $7,500 saved.
- ✗
Implement the control because it reduces ALE to $2,500.
Why it's wrong here
Reducing ALE to $2,500 is real, but the $12,000 control costs more than the $7,500 it saves, so implementation is not cost-effective. It is tempting because lowering ALE to $2,500 looks attractive, and implementing would be correct if the control cost fell below the $7,500 reduction.
- ✗
Implement the control because ALE is $10,000, and control cost is only $12,000.
Why it's wrong here
ALE is SLE times ARO, giving $10,000; the control costs $12,000 annually and reduces ARO to 0.05, cutting ALE to $2,500, so annual savings of $7,500 never recover the $12,000 spend. Implementing controls is correct when their yearly cost is below the ALE reduction they deliver.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.