One of the company’s assets is valued at $200,000.00. Based on historical data, the exposure factor is 25%, and the Annual Loss Expectancy (ALE) is calculated at $100,000.00. What is the Annualized Rate of Occurrence (ARO)?

The calculation follows the standard quantitative risk analysis formulas. First, determine the Single Loss Expectancy (SLE) by multiplying the Asset Value (AV) by the Exposure Factor (EF). SLE = AV EF SLE = $200,000.00 0.25 = $50,000.00 Next, use the formula for Annual Loss Expectancy (ALE), which is ALE = SLE ARO (Annualized Rate of Occurrence). To find the ARO, rearrange the formula: ARO = ALE / SLE ARO = $100,000.00 / $50,000.00 = 2 Therefore, the Annualized Rate of Occurrence is 2, meaning the event is expected to happen twice per year.

A. 0.4: This is a result of an incorrect calculation. The correct mathematical application of the risk formulas does not yield this value.
B. 1: An ARO of 1 would imply the ALE is equal to the SLE ($50,000), which contradicts the given ALE of $100,000.

1. National Institute of Standards and Technology (NIST). (2012). Guide for Conducting Risk Assessments (NIST Special Publication 800-30, Rev. 1). U.S. Department of Commerce. Page F-3, Appendix F, Section F.3. This document defines the relationship between the key terms: "Annualized Loss Expectancy (ALE) is the product of the single loss expectancy (SLE) and the annualized rate of occurrence (ARO)."

2. Peltier, T. R. (2010). Information Security Risk Analysis (3rd ed.). Auerbach Publications. Chapter 7, "Risk Analysis Methodologies," details the quantitative risk analysis process, explicitly stating the formulas ALE = SLE × ARO and SLE = Asset Value × EF. (This is a widely cited academic and professional text in the field).

3. University of Washington. (n.d.). Risk Management Guide. Office of the CISO. Retrieved from https://ciso.uw.edu/education/risk-management-guide/. The guide defines the formulas under the "Quantitative Risk Assessment" section, stating, "ALE = SLE x ARO."