Quantitative risk questions become much easier once you separate loss per event from how often the event is expected.
The common Security+ calculation chain is:
Asset value × Exposure factor = Single loss expectancy
Single loss expectancy × Annual rate of occurrence = Annual loss expectancy
Fast memory cue: SLE is one event. ARO is frequency per year. ALE is the expected annualized loss.
These are estimates used to support decisions. They are not guarantees that a particular loss will happen on schedule.
1. Formulas at a glance
| Term | Meaning | Formula or form |
|---|---|---|
| Asset value (AV) | Value assigned to the asset or loss scenario | Currency amount |
| Exposure factor (EF) | Percentage of asset value expected to be lost in one event | Percentage or decimal |
| Single loss expectancy (SLE) | Estimated loss from one event | AV × EF |
| Annual rate of occurrence (ARO) | Expected event frequency per year | Events per year |
| Annual loss expectancy (ALE) | Estimated annualized loss | SLE × ARO |
2. Single loss expectancy
Single loss expectancy (SLE) estimates the financial impact of one occurrence.
Use:
SLE = Asset value × Exposure factor
If an asset is valued at $200,000 and one event is expected to cause a 25% loss:
- Convert 25% to 0.25.
- Multiply $200,000 × 0.25.
- SLE = $50,000.
The exposure factor describes the portion affected, not the event frequency.
If a scenario says a fire would destroy 60% of a $500,000 facility:
SLE = $500,000 × 0.60 = $300,000
3. Annual rate of occurrence
Annual rate of occurrence (ARO) expresses expected frequency as events per year.
Common conversions:
| Expected frequency | ARO |
|---|---|
| Twice per year | 2.0 |
| Once per year | 1.0 |
| Once every 2 years | 0.5 |
| Once every 4 years | 0.25 |
| Once every 10 years | 0.1 |
For “once every N years,” a useful shortcut is:
ARO = 1 ÷ N
An ARO of 0.25 does not mean one-quarter of an incident occurs each year. It is an annualized frequency estimate representing roughly one event every four years.
4. Annual loss expectancy
Annual loss expectancy (ALE) estimates the expected loss across a year.
Use:
ALE = SLE × ARO
If one event costs an estimated $50,000 and is expected twice per year:
ALE = $50,000 × 2 = $100,000 per year
If one event costs $300,000 and is expected once every four years:
- ARO = 1 ÷ 4 = 0.25.
- ALE = $300,000 × 0.25.
- ALE = $75,000 per year.
ALE allows events with very different impact and frequency to be compared using the same annualized frame.
5. Work the numbers
Example 1: Ransomware disruption
A business values the affected service and associated loss exposure at $400,000. A modeled ransomware event would cause a 30% loss. The event is estimated to occur once every two years.
Step 1: SLE
$400,000 × 0.30 = $120,000
Step 2: ARO
1 ÷ 2 years = 0.5
Step 3: ALE
$120,000 × 0.5 = $60,000 per year
Example 2: Equipment damage
A specialized system is valued at $80,000. Each event is expected to cause a 10% loss and occurs an estimated three times per year.
SLE
$80,000 × 0.10 = $8,000
ALE
$8,000 × 3 = $24,000 per year
Example 3: Solve backward
A scenario gives an ALE of $40,000 and an ARO of 0.5.
Because:
ALE = SLE × ARO
then:
SLE = ALE ÷ ARO
$40,000 ÷ 0.5 = $80,000
Read what the question asks before multiplying every number you see.
6. Compare control cost and loss
ALE can help frame whether a proposed control is economically reasonable, but the cheapest numerical answer is not automatically the correct business decision.
Assume:
- current ALE = $120,000
- ALE after a proposed control = $35,000
- annual control cost = $40,000
The modeled annual loss reduction is:
$120,000 − $35,000 = $85,000
After accounting for the $40,000 annual control cost, the simple modeled benefit is still positive.
That supports the control financially, but the organization may also consider:
- safety
- legal or regulatory requirements
- contractual obligations
- reputation
- strategic priorities
- uncertainty in the estimates
- risk appetite and tolerance
A risk calculation informs the decision. It does not replace governance.
7. Qualitative vs. quantitative
Quantitative analysis uses numerical values such as dollars, probabilities, frequencies, and expected loss.
Examples:
- SLE
- ARO
- ALE
- dollar impact
- expected annual cost
Qualitative analysis uses ordered categories or descriptive judgments.
Examples:
- low / medium / high
- rare / possible / likely
- minor / moderate / severe
A hybrid approach may use scored scales or ranges.
The exam clue is the kind of output the question wants. If the organization needs a dollar estimate for expected annual loss, think quantitative. If it needs a prioritized risk matrix when precise financial data is unavailable, qualitative analysis may fit better.
8. Common exam traps
Trap: using a percentage as a whole number
25% = 0.25, not 25.
$100,000 × 25 would produce an obviously unrealistic SLE.
Trap: treating ARO as a percentage of damage
ARO measures expected frequency. Exposure factor measures the percentage lost in one event.
Trap: reversing the “once every N years” conversion
Once every five years means:
ARO = 1 ÷ 5 = 0.2
It does not mean an ARO of 5.
Trap: confusing SLE and ALE
- One event → SLE
- Annualized expectation → ALE
Trap: assuming ALE predicts the exact next year
ALE is a planning estimate. A $50,000 ALE does not mean exactly $50,000 will be lost next year.
Trap: ignoring nonfinancial requirements
A control may still be required because of safety, law, contract, or business necessity even when a simple ALE comparison looks unfavorable.
9. Rapid review grid
| Question clue | Think |
|---|---|
| Value of the asset or modeled loss exposure | Asset value |
| Percent lost in one event | Exposure factor |
| Expected loss from one event | SLE = AV × EF |
| Expected events per year | ARO |
| Once every N years | ARO = 1 ÷ N |
| Expected annualized loss | ALE = SLE × ARO |
| Dollar/frequency analysis | Quantitative |
| Low/medium/high prioritization | Qualitative |