Legacy ERP: Quantifying the Deferral
Arcadia Logistics runs a 14-year-old ERP on an unsupported database. A quantitative assessment estimates the asset's replacement value at $4.2M; a successful exploit would destroy or corrupt 35% of records. Current likelihood of a successful attack within a year is estimated at 0.6, based on three near-misses in 18 months. A compensating segmentation project would cost $180,000 per year and, per the vendor's reference cases, reduce annual likelihood to 0.15. The board's risk appetite permits no more than $250,000 in expected annual loss from any single system. The CFO argues the project should wait until the ERP is replaced in 2027.
1. Compute the annualized loss expectancy before and after the segmentation project and assess the result against the board's appetite statement.
Read the worked answer
Single loss expectancy = $4.2M x 35% = $1.47M.
- Current ALE = $1.47M x 0.6 = $882,000
- Residual ALE = $1.47M x 0.15 = $220,500
Residual risk alone sits inside the $250,000 appetite. Control cost plus residual loss is $400,500, which does not. That gap is the real finding: it exposes an ambiguity the committee must resolve - is the appetite expressed on expected loss, or on total cost of risk? The practitioner should force that definitional decision rather than quietly adopting the reading that produces compliance.
Both figures are point estimates. The 0.6 likelihood rests on a three-event sample and deserves a range before anyone treats $220,500 as a settled conclusion.
2. How should the risk practitioner respond to the CFO's proposal to defer until the 2027 ERP replacement?
Read the worked answer
Deferral retains roughly $700,000 of expected annual loss to avoid spending $180,000 - and does so while the expected loss sits above the board's stated appetite. That is not a cost-saving argument; it is a decision to carry risk the board said it would not carry.
So reframe it: the question is not whether the CFO prefers to wait, but who is entitled to accept a loss above the appetite threshold. That authority rests with the body that owns the appetite, normally the board or its risk committee. If deferral proceeds, it proceeds as a recorded acceptance with a stated rationale, not as an unminuted budget preference.
Also test the dependency. The 2027 date is an assumption about a replacement program that has not been funded in this scenario. Treating it as a commitment lets the organization book an uncertain future date as if it were a control.
3. What would most weaken this analysis, and what check would you require before the committee relies on it?
Read the worked answer
Two weaknesses matter most.
First, single-point estimates from a small sample: three near-misses in 18 months gives an ARO with wide confidence bounds, so the precision of $882,000 overstates what is actually known. Second, the 35% exposure factor is an assumption about data recoverability that should be tested against evidence - if the last restore test took days rather than hours, or restored less than expected, the loss is understated.
Require a sensitivity run across plausible ranges (for example likelihood 0.3 to 0.8, exposure factor 25% to 50%) and report whether the recommendation holds at the edges or flips. A conclusion that is stable across the range is defensible; one that only survives the central estimate should be presented as conditional, with the swing factors named.