ARO Calculation: How to Find Annualized Rate of Occurrence

Quick Answer

The annualized rate of occurrence comes out to 5 because ARO is derived by dividing the total expected annual loss by the loss expected from a single occurrence: ARO = ALE / SLE = $150,000 / $30,000 = 5. Understanding why this division works requires seeing how the three figures relate to each other conceptually. SLE represents the financial impact of one instance of the risk materializing, in this case, one ransomware event encrypting the file servers. ALE represents the total expected financial impact over an entire year, accounting for how often that event is expected to happen. Since ALE is built by multiplying SLE by ARO in the first place, reversing that relationship to solve for ARO simply means dividing the annual figure by the per-incident figure to recover the frequency, meaning how many times per year would this specific-sized loss need to occur to add up to the given annualized total. An ARO of 5 means the organization's risk model assumes this type of ransomware event is expected roughly five times per year, which is a striking frequency that would strongly justify prioritizing controls to prevent it. This calculation is a foundational piece of quantitative risk analysis, and any question giving you two of the three values, SLE, ARO, or ALE, is testing whether you can rearrange the same core formula to solve for the missing third value.