Updated 1 Nov 2026 · 7 min read
On this page
After this page you will be able to calculate a single loss expectancy and an annualized loss expectancy from an asset value, an exposure factor and a rate of occurrence, and then use those numbers to decide whether a security control pays for itself. Every amount below is in one currency unit, so no symbol is shown. Work through the examples with a calculator and you will have the method, not just the acronyms.
Qualitative and quantitative risk analysis
There are two broad ways to analyse risk. NIST defines a qualitative assessment as one that assesses risk "based on nonnumerical categories or levels", such as high, moderate and low. A quantitative assessment is based "on the use of numbers where the meanings and proportionality of values are maintained inside and outside the context of the assessment." In plain terms, a quantitative result of 25,000 means 25,000, and it is twice as bad as 12,500. A qualitative "high" has no fixed numeric meaning outside the scale that produced it.
ISACA's glossary describes qualitative risk analysis as an approach based on expert opinion, judgement, intuition and experience, and quantitative risk analysis as a calculation of a risk's likelihood and impact using numerical and statistical techniques. The formulas on this page belong to the quantitative side. NIST IR 8286A Rev. 1 notes that there are benefits to both methods, and even to using several of them together, so you should not treat one as simply better than the other.
The five terms: AV, EF, SLE, ARO and ALE
| Term | What it means | Unit |
|---|---|---|
| Asset value (AV) | The value of an asset to the business and to competitors, in ISACA's wording | Money |
| Exposure factor (EF) | The percentage of the asset's value lost when the threat occurs once | Percentage |
| Single loss expectancy (SLE) | The loss from one occurrence of the event | Money |
| Annualized rate of occurrence (ARO) | How many times in a one-year interval the event is expected to happen | Occurrences per year |
| Annualized loss expectancy (ALE) | The total expected loss from that risk over a year | Money per year |
NIST IR 8286A Rev. 1 describes the SLE as the loss for each occurrence and the ALE as the total loss for a risk over an annual period. The CompTIA SY0-701 objectives use the names "annualized loss expectancy" and "annualized rate of occurrence". The ISACA Journal article cited below writes "annual loss expectancy" and "annual rate of occurrence" for the same ideas, so expect both spellings in study material.
The two formulas
These two formulas are not taken from a standard. The NIST reports, the ISACA glossary and the exam documents used for this page do not state them, and the SY0-701 objectives list the terms without formulas. The source here is a 2021 ISACA Journal article by Volkan Evrin, which gives both relationships. The SLE equals the asset value multiplied by the exposure factor, and the ALE is calculated by multiplying the SLE by the ARO.
SLE = AV × EF ALE = SLE × ARO
Write the exposure factor as a decimal when you multiply: 25 per cent becomes 0.25 and 100 per cent becomes 1. The ARO can be less than 1. An event expected once every ten years has an ARO of 0.1, which is exactly how the ISACA article writes it.
Worked example: a database server
A database server and the data on it have an asset value of 200,000. You estimate that a ransomware infection would destroy a quarter of that value through lost records and rebuild effort, so the exposure factor is 25 per cent. Based on your incident history, you expect one such infection every two years.
SLE = 200,000 × 0.25 = 50,000 ARO = 1 event every 2 years = 0.5 ALE = 50,000 × 0.5 = 25,000 per year
Now a second case where the ARO is above 1. A laptop has an asset value of 1,500 and a stolen laptop is a total loss, so the exposure factor is 100 per cent. If you lose six laptops a year, the numbers are:
SLE = 1,500 × 1 = 1,500 ARO = 6 ALE = 1,500 × 6 = 9,000 per year
The two examples show why you need both formulas. The laptop's single loss is small, but frequency multiplies it into a yearly figure you can compare with other risks.
Is the control worth it? Cost-benefit with ALE
The ISACA Journal article describes the cost-benefit step as finding the difference in ALE before and after a countermeasure is implemented, and it says the ARO after a countermeasure may not be zero. ISACA's glossary defines cost-benefit analysis as adding the positive factors and subtracting the negative ones to build a business case for a risk response. The yearly saving in ALE is the positive factor and the yearly cost of the control is the negative one, which gives this check:
Value of control = ALE before - ALE after - annual cost of control
Return to the database server. Better email filtering and endpoint protection cut the expected infections from one every two years to one every ten years, and they cost 8,000 a year to run.
ALE before = 50,000 × 0.5 = 25,000 ALE after = 50,000 × 0.1 = 5,000 Value = 25,000 - 5,000 - 8,000 = 12,000 per year
A positive result means the control saves more than it costs on these estimates. If the same control cost 22,000 a year, the result would be 25,000 minus 5,000 minus 22,000, which is minus 2,000, so it would cost more than the loss it prevents.
A control can also work on the exposure factor instead of the rate. Suppose tested offline backups mean an infection now destroys only 5 per cent of the value. The SLE becomes 200,000 × 0.05 = 10,000, and with the ARO still at 0.5 the ALE after is 10,000 × 0.5 = 5,000. Different mechanism, same ALE after, so the same cost-benefit check applies.
Where people go wrong
People often mix up the SLE and the ALE because both are sums of money. Ask whether the figure is per event or per year: per event is the SLE, per year is the ALE. A second slip is entering the exposure factor as a whole number, which makes 25 per cent act like 25. A third is assuming the ARO must be a whole number, when once every ten years is 0.1. Finally, people compare a control's cost with the SLE instead of with the reduction in ALE. The cost-benefit check needs the ALE before and after, not a single loss.
NIST's own risk register guidance uses a related idea called risk exposure. NIST IR 8286B-upd1 says it represents the total loss if the risk occurs multiplied by the probability that the risk will happen. One of its example risk register entries records a 10 per cent likelihood, an impact of 1,500,000 and an exposure rating of 150,000, which is the likelihood multiplied by the impact. The shape is the same as SLE × ARO, but NIST multiplies by a probability, while ALE multiplies by an expected number of occurrences per year.
How this fits your exam
ISC2 CISSP. The CISSP exam outline, effective 15 April 2024, includes objective 1.9, "Understand and apply risk management concepts", which lists risk analysis, assessment and scope, and risk response and treatment. The outline does not name SLE, ALE or ARO. Our CISSP study guide covers the rest of Domain 1.
CompTIA Security+ SY0-701. Objective 5.2, "Explain elements of the risk management process", lists qualitative and quantitative risk analysis, single loss expectancy (SLE), annualized loss expectancy (ALE), annualized rate of occurrence (ARO), probability, likelihood, exposure factor and impact. Exposure factor also appears in objective 4.3 on vulnerability management. CompTIA says Security+ V8 is expected on or around 17 November 2026, and the English SY0-701 exam retires on 11 June 2027. See the Security+ SY0-701 guide for the full domain list.
ISACA CISM. Domain 2, Information Security Risk Management, carries 20 per cent of the exam. Its subtopics include risk assessment and analysis, and risk treatment and response options. The outline does not name the formulas. ISACA says the CISM exam content outline will be updated effective 3 November 2026, so check the new outline if you sit after that date.
Frequently asked questions
Can the ARO be less than 1?
Yes. The ARO is how many times in a one-year interval the event is expected to occur, so an event expected once every ten years has an ARO of 0.1, and one expected once every two years has an ARO of 0.5. Multiply the SLE by that decimal to get the ALE.
What if a control costs more than one year's loss?
A one-off cost can still make sense. In NIST IR 8286B-upd1, a 250,000 fix for a risk with an exposure rating of 150,000 is described as exceeding a single-year exposure but possibly making sense when considering annualized loss expectancy over time. Weigh the cost against the ALE saved across the years the control will last.
Is ALE the same as NIST's risk exposure?
They are close relatives but not identical. ALE is the SLE multiplied by the expected occurrences per year. NIST IR 8286B-upd1 describes risk exposure as the total loss if the risk occurs multiplied by the probability that it will happen. Use whichever definition the question or your organisation's method sets out.
Sources
- CompTIA Security+ SY0-701 Certification Exam: Exam Objectives
- CISSP Certification Exam Outline
- NIST IR 8286A Rev. 1, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management
- NIST IR 8286B-upd1, Prioritizing Cybersecurity Risk for Enterprise Risk Management
- Risk Assessment and Analysis Methods: Qualitative and Quantitative (ISACA Journal)
- ISACA Glossary
Read the full CISSP guide, then test your risk arithmetic with free CISSP practice questions.