CRISC Risk Response and Reporting Practice Question
During a cost-benefit analysis for a proposed control, the annual loss expectancy (ALE) for a risk is currently $500,000. The control is expected to reduce the ALE by 80% and will cost $150,000 per year. What is the net benefit of implementing the control?
⚠ Common exam trap
The trap here is that candidates often forget to subtract the annual control cost from the gross savings, mistakenly selecting the gross savings ($400,000) as the net benefit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$250,000
The current annual loss expectancy (ALE) is $500,000. An 80% reduction means the control saves $400,000 per year. Subtracting the annual control cost of $150,000 yields a net benefit of $250,000. This is calculated as (ALE × reduction percentage) – control cost.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$100,000
Why it's wrong here
This treats the 80% reduction as $400,000 and subtracts nothing further, omitting the $150,000 annual control cost. It would be the correct figure if the question asked for the risk reduction value alone, before control expenditure is deducted to arrive at net benefit.
- ✓
$250,000
Why this is correct
The control reduces the $500,000 ALE by 80%, a $400,000 saving, against a $150,000 annual cost. Subtracting that cost gives a net benefit of $250,000. The calculation uses the ALE reduction minus the control's yearly expense, matching the stated figures exactly.
- ✗
$400,000
Why it's wrong here
Net benefit is the ALE reduction minus the control cost: $400,000 minus $150,000, giving $250,000. $400,000 is only the 80% risk reduction, ignoring the annual control cost. The correct answer subtracts that cost from the mitigated loss figure.
- ✗
$350,000
Why it's wrong here
This figure subtracts only the $150,000 control cost from the $500,000 ALE, ignoring the 80% risk reduction entirely. That calculation suits a scenario asking for total cost of the control plus residual risk, not net benefit, which requires the $400,000 mitigated loss to be credited first.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.