5.2 Qualitative vs. Quantitative Risk Analysis, SLE, and ALE Calculations

🎯 Key CompTIA Security+ Exam Takeaways

• Qualitative risk analysis uses subjective descriptive scales (Low, Medium, High) and probability/impact matrices.
• Quantitative risk analysis calculates exact dollarized financial metrics using concrete mathematical formulas.
• Single Loss Expectancy (SLE) = Asset Value (AV) × Exposure Factor (EF).
• Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO).
• Risk treatment options: Avoidance (eliminate the activity), Transference (insurance/outsourcing), Mitigation (deploy controls), Acceptance (retain the risk).

Risk management is the systematic process of identifying, evaluating, and addressing organizational security risks. Risk assessments divide into qualitative and quantitative methodologies. Qualitative risk assessment evaluates risks using subjective descriptive scales (such as 1–5 scoring or Low/Medium/High matrices) based on team consensus. While rapid and easy to understand, qualitative methods lack concrete financial precision.

Quantitative risk assessment assigns concrete financial values to assets and threats, utilizing standardized formulas to cost-justify security controls: 1) Asset Value (AV) is the total financial worth of the resource; 2) Exposure Factor (EF) represents the percentage of asset value lost when a specific incident occurs; 3) Single Loss Expectancy (SLE) is the monetary loss expected each single time the threat occurs ($\text{SLE} = \text{AV} \times \text{EF}$); 4) Annualized Rate of Occurrence (ARO) is the estimated number of times the incident occurs in a single year; and 5) Annualized Loss Expectancy (ALE) represents the total expected financial loss over a full year ($\text{ALE} = \text{SLE} \times \text{ARO}$).

Once risks are quantified, leadership selects a risk treatment strategy: 1) Risk Mitigation (Reduction): implementing security controls (firewalls, training) to lower likelihood or impact; 2) Risk Transference: shifting the financial burden to an external third party (such as purchasing cyber insurance or outsourcing services); 3) Risk Avoidance: exiting the business process or decommissioning the vulnerable technology entirely; and 4) Risk Acceptance: formally choosing to bear the residual risk within organizational risk appetite.

⚠️ Common Pearson VUE Exam Traps

• Confusing ARO calculation direction; if an incident happens once every four years, ARO is 0.25 (not 4.0). If it happens four times a year, ARO is 4.0.
• Treating cyber insurance as risk mitigation; insurance is Risk Transference because it transfers financial liability to the underwriter without reducing the actual vulnerability.