Risk Identification, Monitoring, and Analysis →hardMultiple ChoiceObjective-mapped

SSCP Risk Identification, Monitoring, and Analysis Practice Question

An organization's risk register lists a vulnerability with an annualized loss expectancy (ALE) of $50,000. The cost of implementing a mitigation control is $40,000 with an expected lifespan of 5 years. The control is expected to reduce the ALE by 80%. What is the net present value (NPV) of implementing this control over 5 years, assuming a discount rate of 5%? (Ignore residual risk for simplicity.)

⚠ Common exam trap

The trap here is that candidates often forget to discount future savings to present value, leading them to pick the undiscounted total savings ($200,000) or a simple subtraction ($160,000), rather than applying the 5% discount rate correctly.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

$133,180

The net present value (NPV) is calculated by subtracting the initial control cost from the present value of the annual savings over 5 years. The control reduces the ALE by 80%, saving $40,000 per year ($50,000 × 0.8). Using a 5% discount rate, the present value of these savings is $40,000 × 4.3295 (PV annuity factor for 5 years at 5%) = $173,180. Subtracting the $40,000 implementation cost gives an NPV of $133,180.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
$120,000
Why it's wrong here
This does not account for discounting correctly.
✓
$133,180
Why this is correct
Correctly calculated NPV.
✗
$200,000
Why it's wrong here
This represents total undiscounted savings.
✗
$160,000
Why it's wrong here
This ignores discounting.

Go deeper

SSCP Risk Identification, Monitoring, and Analysis Practice Question

Why each option matters

Option-by-option breakdown

Related to this question