hardMultiple SelectObjective-mapped
CRISC Practice Question: Is implementing a quantitative risk assessment…
An organization is implementing a quantitative risk assessment for its customer database. Which TWO elements are essential for calculating the annualized loss expectancy (ALE)?
⚠ Common exam trap
Test-takers frequently confuse the components of SLE (AV and EF) with the ALE formula itself, mistakenly thinking control effectiveness or inherent risk scores are direct multipliers in the ALE calculation, when in fact they are separate risk assessment inputs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Annualized rate of occurrence (ARO)
The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). SLE itself is derived from the asset value (AV) multiplied by the exposure factor (EF), making AV the second essential element. Without both ARO and AV, you cannot compute the expected monetary loss over a one-year period for the customer database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Annualized rate of occurrence (ARO)
Why this is correct
ARO is directly multiplied by SLE to derive ALE.
- ✗
Control effectiveness rating
Why it's wrong here
Control effectiveness is used in residual risk calculation, not directly in ALE.
- ✓
Asset value (AV)
Why this is correct
AV is used to compute SLE, which is part of ALE.
- ✗
Inherent risk score
Why it's wrong here
Inherent risk score is a qualitative measure, not a quantitative input for ALE.
- ✗
Risk appetite threshold
Why it's wrong here
Risk appetite is a qualitative factor, not a quantitative input for ALE.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.