Residual Risk: ALE After Control Implementation

Quick Answer

The answer is $200,000, which represents the residual risk after control implementation. This is correct because residual risk is defined as the remaining Annual Loss Expectancy (ALE) after controls are applied, and the problem explicitly states that the ALE is reduced to $200,000 following the encryption control. The $150,000 annual control cost is a separate figure used for cost-benefit analysis, not for calculating residual risk, which focuses solely on the loss exposure that persists despite safeguards. On the CRISC exam, this question tests your understanding that residual risk is the leftover ALE, not the ALE minus control costs—a common trap where candidates mistakenly subtract the control expense. Remember the key distinction: control costs inform ROI calculations, while residual risk is simply the post-control ALE. A helpful memory tip is “Residual = Remaining ALE,” so when you see a post-control ALE figure, that is your residual risk answer.