Risk Assessment and Loss Prevention
What this domain covers
Risk Assessment and Loss Prevention tests structured identification of assets, threats, and vulnerabilities, the arithmetic of risk, and countermeasure selection. It also covers shrinkage, internal theft, and crime prevention through environmental design (CPTED).
Core rules
- Risk combines likelihood and consequence. A simple matrix (low, medium, high) is qualitative; annualized loss expectancy (ALE) is quantitative.
- SLE = asset value × exposure factor. ALE = SLE × annualized rate of occurrence (ARO).
- Treatment options: avoid, reduce, transfer (insurance), or accept. Every treatment leaves residual risk that must be documented and accepted by the asset owner.
- Layered defense: perimeter, building envelope, interior space, and asset. No single control should be the only barrier.
- CPTED principles: natural surveillance, natural access control, territorial reinforcement, and maintenance. Lighting, sightlines, signage, and landscaping are controls, not decoration.
- A security survey moves from pre-survey document review to site walk, interviews, analysis, and a written report with prioritized recommendations.
- Shrinkage has four typical sources: external theft, internal theft, process or paperwork error, and vendor fraud. Inventory data alone cannot separate them; exception reporting and audits are needed.
Worked example
A warehouse holds $1,200,000 of inventory. Historical data shows an 8 percent exposure per incident and 1.5 incidents per year. SLE = $1,200,000 × 0.08 = $96,000. ALE = $96,000 × 1.5 = $144,000. A proposed camera and access control package costs $45,000 per year and is expected to cut ARO to 0.3. The new ALE is $28,800, a reduction of $115,200, which exceeds the annual cost, so the countermeasure is justified. The residual $28,800 is documented and accepted.
Traps that cost marks
Confusing SLE with ALE; multiplying asset value by ARO without the exposure factor; ignoring residual risk; and assuming a compliance certificate eliminates risk. Also watch for answers that propose a single control as a complete solution, or that treat every loss as external theft when process error and internal theft are common.