Communicating which of the following would be MOST helpful to gain senior management support for risk treatment options?

Senior management is primarily accountable for the organization's financial health and strategic objectives. Communicating potential risk in terms of quantitative financial loss, such as Annualized Loss Expectancy (ALE), translates abstract threats into concrete business impacts. This approach enables a clear cost-benefit analysis of proposed risk treatment options, directly aligning security investments with business value preservation. Presenting data in monetary terms is the most effective language for securing executive support and facilitating informed, business-driven decisions on resource allocation for risk mitigation.

B. Industry benchmarks: Benchmarks provide comparative context but do not quantify the specific financial risk to the organization, which is management's primary concern for decision-making.

C. Threat analysis: This identifies potential dangers in technical terms but lacks the business impact context that financial figures provide to justify expenditure to a non-technical audience.

D. Root cause analysis: This is a reactive tool used to analyze past incidents to prevent recurrence, not to proactively communicate future potential risks to gain support for new investments.

---

1. ISACA

CISM Review Manual

15th Edition (2022): Chapter 2

Section 2.5

"Risk Analysis and Evaluation." The manual states

"The primary advantage of quantitative risk analysis is that the results can be used in a cost-benefit analysis of recommended controls... Because the results are expressed in monetary terms

they are easily understood by senior management."

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018): EDM03

"Ensure Risk Optimization." This governance objective emphasizes the need to "Articulate risk and opportunity to stakeholders in business terms." Quantitative loss is the most direct and universally understood business term for risk impact.

3. Fenz

S.

& Ekelhart

A. (2011). Formalizing Information Security Knowledge. Proceedings of the 44th Hawaii International Conference on System Sciences. (DOI: 10.1109/HICSS.2011.138). This and similar academic works on security ontologies and risk management highlight that for decision support (a key function of senior management)

risk metrics must be translated into business impact

with financial loss being a primary metric.