Study Guide
Quantifying Impact: ALE and Business Impact Analysis
Single Loss Expectancy, Annualised Rate of Occurrence and Annualised Loss Expectancy, what an annual loss estimate does and does not mean, and how Business Impact Analysis shows what matters most.
Lesson 5.5 Governance, Risk & Compliance
A risk matrix can say that one risk ranks above another, but a manager deciding whether to spend money on a control usually wants to know what the risk might cost. This lesson works out a simple way to turn a loss estimate and an expected frequency into an annual figure, then asks a different question: how important is an activity to the business?
Stage: Think
What might it cost?
Think it through
A manager must decide whether to spend £3,000 a year on a control against ransomware. One incident would cost about £20,000, and one is expected roughly every four years. How could you turn those two figures into something to compare with the £3,000?
- Hint 1: If £20,000 is lost every four years, how much is that per year, on average?
Show what happens
Spread the expected loss over the years: £20,000 every four years is, on average, £5,000 a year. That annual figure can be compared with what a control costs, and with how much loss it would prevent.
Think it through
Show the answer
Answer: A. No: most years may cost nothing.
No. It is an average: a year with no incident and a year with a much larger loss both fit the same estimate.
Stage: Explain
Annualised Loss Expectancy
SLE × ARO = ALE is a simplified quantitative model. It distinguishes a loss from one incident from the expected loss over a year.
| Measure | Meaning and units | Worked value |
|---|---|---|
| SLE · Single Loss Expectancy | Estimated loss if this incident happens once; pounds per incident. | £20,000 per ransomware incident. |
| ARO · Annualised Rate of Occurrence | Expected incident frequency per year. | Once every four years on average: 1 ÷ 4 = 0.25 incidents per year. |
| ALE · Annualised Loss Expectancy | Estimated average annual loss under the stated assumptions; pounds per year. | £20,000 × 0.25 = £5,000 per year. |
The calculation: £20,000 × 0.25 = £5,000 annualised loss.
Check your understanding
Show the answer
Answer: C. £40,000
£40,000: £20,000 × 2. ARO is a frequency, so it can be more than 1.
Both figures are estimates made for the example: the £20,000 loss and the frequency. If the estimated frequency were once a year, ARO would be 1; twice a year would be 2; once every two years would be 0.5; once every five years would be 0.2. This makes clear that ARO is an expected event frequency, not automatically a probability bounded by 1.
What £5,000 per year means
The model spreads the expected loss across a year for comparison and planning. It does not predict a £5,000 cash payment every year. A year with no incident and a year with a much larger loss are both compatible with an annualised estimate. Nor does “once every four years” mean that incidents occur at exact four-year intervals.
An ARO of 0.25 should not automatically be described as a 25% probability of at least one incident during a year; that interpretation needs additional modelling assumptions. ALE also does not show the full range of possible losses or the organisation’s ability to survive an unusually severe event.
Before relying on the figure, record what the loss estimate includes, how frequency was estimated and the period and conditions to which the assumptions apply. Recovery costs, lost activity and consequences for affected people should not vanish merely because they are hard to estimate. Avoid counting the same loss twice.
Using the estimate in a treatment decision
Think it through
Show the answer
Answer: B. Only if it saves more.
Only if it reduces the expected loss by more than it costs. A control may prevent only some of the £5,000.
Compare a proposed control’s cost with the expected reduction in loss, not automatically with the entire £5,000. A control might address only some attack paths or reduce impact rather than eliminate incidents. Its effectiveness must be supported by evidence before assigning a lower frequency or loss estimate.
ALE is one input alongside business priorities, safety, obligations, uncertainty and the consequences of a severe loss. It is not a complete risk assessment, an automatic spending limit or evidence that any control costing less than £5,000 must be worthwhile.
Stage: Predict
Where the single loss figure comes from
The ransomware calculation takes the £20,000 single loss as given. A common way to build that figure uses two further estimates:
SLE = Asset value × Exposure factor
The asset value is what the affected asset is worth to the organisation, including the cost of replacing or recovering it. The exposure factor is the fraction of that value one incident would be expected to destroy, written as a decimal or a percentage.
Think it through
Show the answer
Answer: C. £20,000
£20,000: £50,000 × 0.4, the same single loss the ransomware example used.
If the systems and data affected by the ransomware were valued at £50,000, and one incident was expected to cost 40% of that value, then SLE = £50,000 × 0.4 = £20,000, the same figure the example used. This breakdown shows one way an organisation might arrive at the estimate and makes its assumptions visible.
Stage: Predict
Worked control comparison
This comparison extends the ransomware calculation with two fictional controls. One reduces how often the incident happens; the other reduces how much it costs when it does.
Think it through
Control A makes incidents rarer, about once every ten years. Control B makes each incident cheaper, £8,000. Before looking at the figures, predict each new ALE.
- Hint 1: Which figure does each control change, SLE or ARO?
Show what happens
A: £20,000 × 0.1 = £2,000. B: £8,000 × 0.25 = £2,000. The same ALE by two different routes; what each costs decides which saves more.
All figures are computed as SLE × ARO. The baseline is the ransomware estimate from this lesson; the two controls are fictional illustrations with assumed effects and costs.
Baseline · Ransomware estimate
SLE £20,000 × ARO 0.25 = ALE £5,000 per year
One incident costs £20,000 and is expected once every four years.
Control A: stronger email filtering and faster patching
SLE £20,000 × ARO 0.1 = ALE £2,000 per year
Assumed to make an incident less frequent, about once every ten years. The cost of one incident is unchanged.
Expected reduction: £3,000 per year · Control cost: £1,800 per year · Expected saving exceeds cost by £1,200.
Control B: tested offline backups
SLE £8,000 × ARO 0.25 = ALE £2,000 per year
Assumed to reduce the cost of one incident by allowing faster recovery. The frequency is unchanged.
Expected reduction: £3,000 per year · Control cost: £3,500 per year · Cost exceeds expected saving by £500.
Both controls reduce ALE to £2,000, by different routes. On these assumptions only Control A saves more than it costs, yet Control B might still be justified: ALE ignores how severe a single bad year could be, legal duties and the value of recovering at all.
Check your understanding
Show the answer
Answer: B. Only Control A.
Only Control A. Control B might still be justified for other reasons, which the note under the comparison names.
This is the “expected reduction in loss” comparison from the treatment decision, applied to numbers. The effects and costs are assumptions made for teaching; a real decision would need evidence that a control actually changes the frequency or the loss.
Stage: Predict
Business Impact Analysis
Think it through
A customer database fails. Which is the more useful question: “how important is the server?” or “how important is the work people do with it?” Why?
- Hint 1: What do people lose when the database fails?
Show what happens
The work. The same server can matter enormously to one activity and hardly at all to another, and restoring the server alone may not restore the activity if it depends on other things.
A memory aid: BIA = “How important is this to the business?” A Business Impact Analysis starts with important activities and examines what disruption would mean, including dependencies and consequences over time. It helps identify recovery priorities and tolerable disruption, informing the impact side of risk assessment and continuity planning. NIST’s BIA definition connects business processes, disruption effects and recovery requirements.
Follow the activity, not just the server
A Business Impact Analysis starts from an activity that people carry out, not from a piece of equipment. The fictional organisation’s customer-service team uses the customer database all day to answer enquiries and take bookings. Work through what losing it would mean.
- Which activity stops? Staff cannot look up a customer or record a new booking.
- How long can the team manage without it? They can take bookings on paper forms. After about two hours the paper backlog becomes too large to clear the same day. So the activity must be working again within two hours. That target is the recovery time objective (RTO): the longest the organisation has decided it can go without something.
- How much recent data could they afford to lose? If the database had to be restored from a copy, everything entered since that copy would be gone. The team could re-enter one day’s bookings from emails and paper, and no more. So the organisation can afford to lose at most 24 hours of data. That is the recovery point objective (RPO): the most data, measured as time, that it can afford to lose.
- What do the two figures require? An RPO of 24 hours means a backup at least every night. An RTO of two hours means a restoration that takes less than two hours, which has to be practised to be known.
- What does the activity depend on? The database is no use unless staff can also sign in and reach it across the network. Restoring the database alone would not restore the activity, so the two-hour target covers all three.
Check your understanding
Show the answer
Answer: A. Nightly.
At least nightly, so that no more than a day’s data could be lost.
The result: two numbers that turn “the database is important” into requirements someone can meet and test: back up nightly, and be able to restore everything the team needs within two hours.
Think it through
Suppose bookings arrived only by telephone, with nothing written down. What happens to the RPO, and to the backup plan?
- Hint 1: Could the team re-enter a day’s calls from memory?
Show what happens
Lost bookings could not be re-entered, so even an hour’s loss is too much: the RPO falls to about an hour, and a nightly backup no longer meets it.
Change one fact. Suppose bookings arrived only by telephone, with nothing written down. Then even an hour’s lost data could not be re-entered. The RPO falls to one hour, a nightly backup no longer meets it, and copies must be taken at least hourly. The system is the same; the answer changed because the activity changed.
RTO and RPO are targets the organisation chooses. Two related figures are measurements of what actually happens.
Go deeper MTTR and MTBF
- Mean time to repair (MTTR) is how long, on average, it takes to get a failed system working again. If MTTR is longer than the RTO, the target is not being met.
- Mean time between failures (MTBF) is how long, on average, a system runs before it fails. A longer MTBF means a more reliable system.
Both are averages taken from records of real failures, so they can only be known for systems that have been running for some time.
CVSS asks about vulnerability severity. BIA examines the consequences of disruption to activities and their dependencies. Risk assessment brings the defined scenario, likelihood, impact, controls and decision criteria together. Each can inform the others, but none is interchangeable with the whole process.
Stage: Predict
How ALE and BIA fit together
Think it through
What might an ALE figure fail to show that a board would care about?
- Hint 1: Is an average the same as the worst case?
Show what happens
How bad a single bad year could be, and harm that is hard to price, such as harm to people. The table compares what each tool shows and leaves out.
| Aspect | ALE | BIA |
|---|---|---|
| Question | What might this particular risk cost per year, on average? | How important is this activity, and what happens as disruption goes on? |
| Starting point | One incident scenario. | A business activity and everything it depends on, whatever the cause of disruption. |
| Output | A money figure per year, under stated assumptions. | Priorities, dependencies and tolerable disruption over time. |
| Says nothing about | The worst single year, or harm that is hard to price. | How likely an attack is. |
The two support each other: a BIA’s view of what disruption costs the business helps estimate the SLE, and its recovery priorities help decide which risks deserve a quantitative estimate at all.
When an annual loss figure appears in a report, check three things before relying on it: what the single loss includes, how the frequency was estimated, and whether the same loss has been counted twice across risks. An estimate with its assumptions written down can be improved; a bare number cannot.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Show the answer
Answer: B. £1,800
£1,800 a year: £600 × 3. An ARO above 1 is normal for frequent incidents.
Apply it
Show the answer
Answer: C. It is an average over years.
ALE is a long-run average for comparison and planning. Next year may cost nothing, or much more.
Apply it
Show the answer
Answer: A. No: the activity needs sign-in too.
No. The target covers the activity, and the activity depends on sign-in as well as the database.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: £5,000 per year
ALE = SLE × ARO = £20,000 × 0.25 = £5,000 per year. This is an expected annualised loss under the assumptions, not a guaranteed annual payment or prediction of regular four-year intervals.
Revision sources: Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Show answer
Answer: ARO 2; ALE £6,000 per year.
ARO is expected incidents per year and can exceed 1. Therefore £3,000 × 2 = £6,000 per year. It is not automatically a probability or percentage. These are illustrative assumptions.
Revision sources: Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Show answer
Answer: False
ALE expresses estimated average annual loss. Actual years can have no loss or much larger losses; frequency and incident-loss estimates are uncertain.
Revision sources: Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Show answer
Answer: Identify critical activities, recovery dependencies and consequences as disruption continues.
BIA follows the business activity and consequences over time. Restoring a database alone may not restore authentication or staff access. It informs impact and recovery priorities without replacing vulnerability assessment or determining likelihood by itself.
Revision sources: Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Study and revision
Practise ALE, ARO and BIA through the Risk Management topic. The questions are learning-only, with no verified exam alignment.
Stage: Consolidate
What to remember
- ALE = SLE × ARO: the loss from one incident times how often it is expected each year.
- ARO is a frequency, not a probability, and can be greater than 1.
- ALE is an average for comparison, not a prediction of any year’s loss.
- Compare a control’s cost with the reduction in loss it brings, not with the whole ALE.
- A BIA starts from the activity: it sets recovery targets (RTO and RPO) and finds dependencies, and says nothing about likelihood.
Key terms
- SLE (Single Loss Expectancy)
The estimated loss if a particular incident happens once.
- ARO (Annualised Rate of Occurrence)
The expected number of times an incident occurs per year. Once every four years is 0.25; twice a year is 2.
- ALE (Annualised Loss Expectancy)
The expected yearly loss from a risk, calculated as ALE = SLE × ARO.
- BIA (Business Impact Analysis)
An analysis of important activities, their dependencies and the consequences of disruption over time, used to set impact and recovery priorities.
Common misunderstandings
ALE is an average over many years. A given year may cost nothing, or far more.
ARO is an expected frequency. Treating it as a probability needs further assumptions, and an ARO can be greater than 1.
Compare the control’s cost with the reduction in loss it is expected to achieve, not with the whole ALE.
BIA examines the consequences of disruption. Likelihood is assessed separately.
Lesson sources and acknowledgements
Sources and scope
- Taught in Session 4 (see the Session 4 Learning Log): SLE, ARO and ALE; ALE = SLE × ARO; the ARO values for different frequencies; the £20,000 ransomware example with ARO 0.25 and ALE £5,000; using ALE to justify spending; BIA as “How important is this to the business?”, informing impact but not likelihood.
- Moved from an earlier lesson: “Annualised Loss Expectancy”, “What £5,000 per year means”, “Using the estimate in a treatment decision”, “Business Impact Analysis” and “Follow the activity, not just the server” were previously part of Risk and keep their wording and anchors here. They develop the supplied, reconstructed GRC educational reference.
- Supplementary explanation: SLE = Asset value × Exposure factor, the two-control comparison and its figures, the worked Business Impact Analysis with its recovery time and recovery point objectives and its “change one fact” variation, the “Go deeper” note on MTTR and MTBF, the ALE and BIA comparison, the practical note and the misunderstandings. The control effects, costs, the £20,000 loss and the two-hour and 24-hour figures are fictional assumptions; no recovery was timed and no loss was measured.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the opening questions about what a risk might cost, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. These are teaching calculations, not a financial assessment of any organisation.
The expected yearly loss from a risk, calculated as ALE = SLE × ARO.
The expected number of times an incident occurs per year. Once every four years is 0.25; twice a year is 2.
Something an organisation values, such as information, a service, equipment or a business capability.
An analysis of important activities, their dependencies and the consequences of disruption over time, used to set impact and recovery priorities.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A standard for rating the technical severity of vulnerabilities. The same base score can carry different business risk depending on context.
The fraction of an asset’s value that one incident would be expected to destroy, used to estimate SLE as asset value × exposure factor.
How serious the consequences of an event would be for the organisation and the people affected.
How probable it is that a defined event will happen over a stated period.
Malicious software that denies access to systems or data, typically by encrypting them, in order to extort payment. Some incidents also involve data theft.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
A grid that rates likelihood against impact, often on 1 to 5 scales, to rank risks into bands.
The most data, measured as a length of time, that an organisation has decided it can afford to lose in a disruption. It sets how often backups must be taken.
The longest time an organisation has decided it can go without an activity or system after a disruption, and so the target for getting it working again.
The estimated loss if a particular incident happens once.
A weakness that a threat may exploit.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.