hardMultiple Select
CRISC Practice Question: Is implementing a quantitative risk assessment…
An organization is implementing a quantitative risk assessment for its customer database. Which TWO elements are essential for calculating the annualized loss expectancy (ALE)?
⚠ Common exam trap
Test-takers frequently confuse the components of SLE (AV and EF) with the ALE formula itself, mistakenly thinking control effectiveness or inherent risk scores are direct multipliers in the ALE calculation, when in fact they are separate risk assessment inputs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Annualized rate of occurrence (ARO)
The ALE formula is ALE = SLE × ARO, where SLE (single loss expectancy) = AV × EF (exposure factor). Option A, annualized rate of occurrence (ARO), is essential because it estimates how many times per year a threat is expected to materialize, directly multiplying the per-incident loss. Option C, asset value (AV), is essential because it feeds into the SLE calculation (AV × EF), representing the monetary worth of the customer database being protected. Control effectiveness rating (B) is not part of the ALE formula; it may inform residual risk but is not a required input. Inherent risk score (D) is a qualitative/derived measure, not a component of ALE. Risk appetite threshold (E) is a governance tolerance used to compare against risk, not a calculation input for ALE.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Annualized rate of occurrence (ARO)
Why this is correct
ALE is derived by multiplying the single loss expectancy by how often the loss occurs each year. The annualised rate of occurrence supplies that frequency figure, so without it the expected yearly loss cannot be quantified for the customer database scenario.
- ✗
Control effectiveness rating
Why it's wrong here
Control effectiveness adjusts likelihood or impact but is not itself an ALE input; the calculation needs single loss expectancy and annualised rate of occurrence. It is tempting because effectiveness modifies residual risk estimates, and would be the correct element when determining residual risk after controls rather than computing ALE.
- ✓
Asset value (AV)
Why this is correct
Asset value quantifies what the customer database is worth, forming the basis of the single loss expectancy. Combined with exposure factor it yields SLE, which is then multiplied by the annualised rate of occurrence to produce ALE.
- ✗
Inherent risk score
Why it's wrong here
Inherent risk score is a qualitative rating before controls, not a monetary figure; ALE needs single loss expectancy multiplied by annualised rate of occurrence. It is tempting because inherent scores feed risk registers and prioritisation, and would be the correct element when ranking risks rather than quantifying expected annual loss.
- ✗
Risk appetite threshold
Why it's wrong here
Risk appetite is a governance tolerance threshold, not a monetary input; ALE requires single loss expectancy and annualised rate of occurrence. It is tempting because appetite guides whether computed risk is acceptable, and it would be the correct element when defining risk criteria rather than performing the ALE calculation itself.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.