Risk and Control Cost-Benefit Calculator (ALE)

Calculate single loss expectancy, annualized loss expectancy and the net benefit of a control — the risk formulas CISM and CISA candidates need.

The formulas

• Single loss expectancy (SLE) = asset value × exposure factor.
• Annualized loss expectancy (ALE) = SLE × annualized rate of occurrence (ARO).
• Net benefit of a control = ALE before − ALE after − annual cost of the control.

A control is worth implementing when its net benefit is positive. When it costs more than it saves, the risk owner may accept the risk or choose another response. See risk response options for CISM and annualized loss expectancy.