The Escrow Platform: ALE, Appetite and a Competing Control
Northbridge Title & Escrow is a 420-employee title insurance agency running a single on-premises data centre. Its risk register holds 31 entries, all scored on a 5×5 heat map. The board has just adopted a risk-appetite statement capping the annualised loss exposure of any Tier-1 asset at $250,000. The only Tier-1 asset is the escrow-funds platform.
For the ransomware scenario affecting that platform, the risk team estimates a single loss expectancy of $2.4 million - recovery, business interruption and contractual penalties - with an annualised rate of occurrence of 0.15. A proposed control package of managed EDR, immutable offsite backups and quarterly restore testing costs $120,000 a year and is expected to cut the rate of occurrence to 0.04.
The CFO wants to approve the spend on the ALE arithmetic alone. The CISO is uneasy: the same money could fund a privileged access management rollout, and the last two external audits flagged shared administrator accounts on the escrow servers. Both proposals are on next month's board agenda.
1. Calculate the current and residual annualised loss exposure for the ransomware scenario. Does the control package bring the platform inside the board's stated appetite, and is the ALE arithmetic by itself sufficient grounds for approval?
Read the worked answer
The arithmetic
- Current ALE = SLE × ARO = $2,400,000 × 0.15 = $360,000/year. That is $110,000 above the $250,000 cap, so the platform is out of appetite today and remediation is not discretionary.
- Residual ALE = $2,400,000 × 0.04 = $96,000/year, which is inside the cap.
- Risk reduction = $360,000 − $96,000 = $264,000 against a $120,000 cost, a net benefit of $144,000 and a ratio of about 2.2:1. Break-even occurs if the control lowers ARO by only 0.05, so the case survives a meaningful estimation error.
Why the arithmetic is not sufficient
The board's cap is on annualised exposure, but a single event costs $2.4 million - 9.6 times the cap. ALE converts a low-frequency, firm-threatening event into a comfortable average and hides that concentration. A defensible appetite statement needs two limits: an annualised exposure cap and a single-event tolerance (or capital/liquidity test). On a single-event basis the platform breaches appetite even after the control.
The 0.15 and 0.04 figures are expert judgement, not loss data; the answer should state the assumption, record who supplied it, and commit to re-estimating after twelve months using observed MTTD and restore-test results.
Conclusion: approve, because the platform is out of appetite and the control is cost-beneficial, but condition approval on measurement and on restating the appetite in single-event terms.
2. The CISO argues privileged access management would be the better use of the same $120,000. How should the two proposals be evaluated against each other?
Read the worked answer
They are not competing treatments for the same risk, so comparing their ALEs directly is the error to avoid.
Decompose by mechanism. The control package mixes two different effects. Immutable backups and restore testing reduce impact (they shorten recovery and cut the SLE); managed EDR reduces likelihood and shortens dwell time. If most of the ARO reduction is being claimed by the backups, then the true comparison is backups-versus-PAM, not the bundle-versus-PAM.
Check whether the register prices the PAM scenario at all. For a title and escrow firm the classic loss is fraudulent disbursement through misused or shared credentials - lower SLE than a full platform rebuild, but a much higher ARO, and often below the detection threshold because the transactions look legitimate. If that entry is missing or scored qualitatively, the CISO is comparing a quantified risk against an unquantified one, which will always favour the quantified one.
Weigh what ALE cannot see. Two consecutive audit findings on shared administrator accounts are evidence that the control environment is already failing in a regulated, trust-dependent process. Escrow is a business whose product is trust; the reputational and licensing tail is not in the $2.4 million.
Practical answer: fund the backup and restore-testing element first - it is the cheapest component and attacks the largest part of the loss - then fund PAM in the same year by deferring the managed detection retainer, and re-score the register so the credential-abuse scenario has a defensible ALE before the next budget cycle.
3. The risk committee asks how the quantitative model should be governed after approval. What would you require?
Read the worked answer
A quantified risk model that influences board decisions needs the same controls as any other decision-support system.
- Documented inputs and provenance. Each SLE component (recovery cost, downtime, contractual penalties) carries a source: the last actual incident, vendor quote, insurance schedule, or named expert. Where the input is judgement, record the range, not just the point estimate.
- Sensitivity before elegance. The committee needs to see which variable moves the answer. Here, a plausible range of 0.10–0.20 on ARO and $1.5M–$3M on SLE should be presented as a band, not a single dollar figure.
- Validation against reality. Track actual incidents, near misses, restore-test durations and insurance claims and feed them back. An unvalidated ARO that never changes is a number nobody is learning from.
- Tie to control performance, not control purchase. The residual ARO of 0.04 is a claim about how the controls will operate. Report MTTD, backup restore success rate and percentage of endpoints with healthy EDR as the evidence that the claim is holding.
- Re-approval triggers. Re-run the model on any Tier-1 architecture change, after any incident exceeding a defined threshold, and at least annually.
- Separation from the decision-maker. The person who owns the control budget should not be the sole author of the ARO estimate; have the estimate challenged by someone with no stake in the outcome.
The governance point is that the model's credibility rests on visible assumptions and measured performance, not on the precision of the arithmetic.