A control comparison with explicit effectiveness and uncertainty
A fictional organization estimates the value exposed by one defined incident scenario at five hundred thousand currency units and the fraction lost in one successful incident at forty percent. Its classroom model estimates an annualized incident rate of one half, and the exercise asks for expected annual loss rather than a prediction that exactly half an incident occurs each year. A proposed control costs twenty-five thousand annually and is estimated to reduce the annualized rate to one tenth without changing the loss fraction. The organization also has nonfinancial service obligations and uncertainty in the frequency estimates. No legal requirement is waived by the financial calculation. A sponsor wants to compare control cost with the full original asset value instead of the modeled reduction in expected loss.
1. Calculate SLE, original ALE and residual ALE under the supplied model.
Read the worked answer
SLE is 500,000 ×0.40 =200,000. Original ALE is 200,000 ×0.5 =100,000. Residual ALE is 200,000 ×0.1 =20,000. The modeled annual reduction is 80,000.
2. Compare the annual control cost and state a limitation.
Read the worked answer
The simple expected financial benefit net of annual control cost is 80,000 −25,000 =55,000. This depends on the estimated effectiveness and incident model, and it does not by itself settle mandatory duties, correlated losses or nonfinancial harm.