Qualitative vs quantitative risk: SLE, ARO, ALE
Qualitative risk analysis rates risks with words or scores such as low, medium and high, based on judgement of likelihood and impact. Quantitative risk analysis puts numbers and money on them. The standard quantitative formulas are SLE = asset value x exposure factor, and ALE = SLE x ARO. SLE is the single loss expectancy, ARO is the annualised rate of occurrence and ALE is the annualised loss expectancy. The decision rule: use qualitative when you need a fast ranking or lack data, use quantitative when someone needs a dollar figure to justify spending, and always compare the yearly risk reduction with the yearly cost of the control.
The calculation in five steps
Worked example: a file server holds order data. The organisation is worried about ransomware.
Step 1: asset value (AV). The server, its data and the cost of rebuilding it are worth 80,000.
Step 2: exposure factor (EF). If ransomware hits, 40 percent of that value is lost (downtime and restoration of data that is not backed up). EF = 0.4.
Step 3: single loss expectancy. SLE = AV x EF = 80,000 x 0.4 = 32,000. This is the loss from one incident.
Step 4: annualised rate of occurrence. The organisation expects one such incident every four years. ARO = 1 / 4 = 0.25. An event expected twice a year has an ARO of 2; one expected every ten years has 0.1.
Step 5: annualised loss expectancy. ALE = SLE x ARO = 32,000 x 0.25 = 8,000 per year.
The 8,000 is an average over a long period, not a prediction for next year. In a given year the loss is zero, 32,000 or a multiple of it, never 8,000.
Is the control worth buying?
Now compare options. The ALE before the control is the baseline.
| Option | Annual cost | New SLE | ARO | New ALE | Risk reduction | Net benefit |
|---|---|---|---|---|---|---|
| Do nothing | 0 | 32,000 | 0.25 | 8,000 | 0 | 0 |
| Offline backups | 5,000 | 8,000 (EF 0.1) | 0.25 | 2,000 | 6,000 | +1,000 |
| Premium monitoring suite | 9,000 | 32,000 | 0.125 | 4,000 | 4,000 | -5,000 |
Net benefit = (ALE before - ALE after) - annual cost of the control. Backups cut the exposure factor and pay for themselves. The monitoring suite halves the likelihood but costs more than the loss it avoids. This is the cost-benefit rule most exams want: a control is justified when the ALE reduction exceeds its annual cost. What remains after the control is the residual risk (2,000 for backups).
If the numbers were reversed, the organisation could still treat the risk another way. The four treatments in the SY0-801 objectives are transferring (insurance, contracts), accepting, avoiding and mitigating. An insurance premium below the ALE is a reasonable transfer. Accepting is rational when the ALE is small or the control costs more than it saves.
Qualitative analysis, in practice
Qualitative analysis scores likelihood and impact on a scale, for example 1 to 5 each, and multiplies or plots them on a heat map. It is quick, needs no historical data and suits workshops. Its weaknesses are subjectivity (one person’s “high” is another’s “medium”) and no way to compare spending to loss. Quantitative analysis needs reliable asset values and event frequencies, which are often guesses for rare events, so the output looks more precise than it is. Many organisations use both: qualitative to triage the register, quantitative on the few top risks. Guidance such as NIST SP 800-30 treats risk assessment as an organisation-wide process feeding decisions at several levels, not a one-off calculation (NIST SP 800-30 Rev. 1).
Where this sits in the risk process: identify assets and risks, assess and score them, analyse impact, likelihood, owner and current mitigations, record them in a risk register, communicate, review, then choose a treatment. Frameworks such as ISO/IEC 27001 build control selection on that process; see security frameworks. Risk assessment also drives priorities in vulnerability management, and AI-specific risk is covered in AI governance and risk.
Which exams test this
| Exam | How it appears | On this site |
|---|---|---|
| SY0-801 | Security Program Management and Oversight domain (14%), objective 5.2: risk identification, assessment and analysis (impact, likelihood, qualitative versus quantitative), risk register, the four treatments, and business-level terms including risk appetite, residual risk, SLE, ALE and ARO | Security program management |
| AAISM | Indirect. AI Risk Management domain (31%), subtopic 2A AI Risk Assessment, Thresholds, and Treatment; the outline does not name qualitative or quantitative methods | Risk management |
| AAIR | Indirect. AI Risk Program Management domain (42%), subtopics 3A AI Risk Scenario Identification and Assessment and 3B AI Risk Treatment Strategies; no calculation method is named | Risk program management |
Only SY0-801 names qualitative versus quantitative analysis and the SLE, ALE and ARO terms. The two ISACA AI exams ask the same likelihood-and-impact and treatment thinking in an AI setting, without the formulas.
How the questions are built
- Given asset value and percentage loss, compute SLE first. “Percentage” or “damages 30 percent” is the exposure factor.
- Given “once every five years”, convert to ARO 0.2. Candidates often type 5.
- “Per year”, “annualised” means multiply by ARO. “Single occurrence” stops at SLE.
- Which is cheaper? Compute the ALE reduction and compare it with annual cost. Do not compare the control’s cost with the SLE.
- “No reliable historical data”, “quick prioritisation”, “heat map” points to qualitative.
- “Justify budget to the board in dollars” points to quantitative.
- The trap: confusing residual risk (what remains after controls) with inherent risk (before controls), and treating risk appetite (how much risk the organisation is willing to take on) as a technical value rather than a management decision.
Practice questions
Question 1. A database server is valued at 150,000. A breach would expose 20 percent of its value, and such a breach is expected three times per year. What is the annualised loss expectancy?
- A. 30,000
- B. 450,000
- C. 90,000
- D. 10,000
Show answer
Answer: C
SLE = 150,000 x 0.20 = 30,000. ALE = SLE x ARO = 30,000 x 3 = 90,000. 30,000 is only the single loss. 450,000 multiplies the full asset value by the ARO and ignores the exposure factor. 10,000 divides instead of multiplying.
Question 2. A risk has an ALE of 12,000. A control costing 7,000 per year reduces the ALE to 3,000. What is the best conclusion?
- A. The control is justified because the ALE reduction of 9,000 exceeds its cost
- B. The control is not justified because its cost is more than the remaining ALE
- C. The control eliminates the risk entirely
- D. The control cannot be evaluated without a qualitative rating
Show answer
Answer: A
The ALE falls by 9,000 and the control costs 7,000 per year, so the net benefit is 2,000 and the control is justified. Comparing cost with the remaining ALE or with the SLE is the wrong test. Residual risk of 3,000 remains, so the risk is reduced, not eliminated.
Go deeper
- NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments
- NIST Cybersecurity Framework, for how risk management is organised across Functions
- Related guides: common attack types, how to study for certification exams