Governance, Risk, and Compliance · Topic 3 of 7
Risk Analysis and Treatment
Practise qualitative and quantitative risk analysis, SLE, ARO and ALE formulas, risk appetite, inherent and residual risk, and the four treatments.
- 4 min
- Risk combines likelihood and impact.
- SLE equals asset value times exposure factor, and ALE equals SLE times ARO.
- Quantitative analysis uses money, qualitative analysis uses ranked categories.
What it is
Risk is the chance that a threat exploits a weakness and causes harm to the business. It is judged by how likely the event is and how large the impact would be.
A security architect does not try to remove all risk. The job is to find the risks, rank them, and choose a response that costs less than the loss it prevents.
How it works
Qualitative and quantitative analysis
Qualitative analysis ranks risks with words or scores such as low, medium and high, often on a heat map. It is fast and needs little data, but it is subjective.
Quantitative analysis uses money and probabilities. It supports cost benefit decisions but needs reliable data.
| Term | Meaning | Formula |
|---|---|---|
| Asset value (AV) | What the asset is worth | Given |
| Exposure factor (EF) | Percentage of the asset lost in one event | Given |
| Single loss expectancy (SLE) | Loss from one event | AV x EF |
| Annualized rate of occurrence (ARO) | Expected events per year | Given |
| Annualized loss expectancy (ALE) | Expected loss per year | SLE x ARO |
Worked example: a server worth 200,000 loses 25 percent of its value in an incident. The SLE is 50,000. If the incident is expected once every two years, the ARO is 0.5 and the ALE is 25,000.
A control is worth buying when it lowers the ALE by more than its yearly cost. If a safeguard costs 30,000 a year and only saves 25,000, the numbers do not support it, unless law or contract requires it.
Inherent, residual and target risk
Inherent risk is the level before any controls. Residual risk is what remains after controls are applied. The organization compares residual risk with its target risk to decide whether more action is needed.
Risk appetite is the broad amount of risk leadership is willing to pursue. Risk tolerance is the acceptable variation around a specific objective. A control that leaves residual risk above tolerance needs improvement or another treatment.
Treatment options
| Option | What you do | Example |
|---|---|---|
| Mitigate (reduce) | Add controls to lower likelihood or impact | Patch, segment, add monitoring |
| Transfer (share) | Move financial impact to another party | Buy cyber insurance, outsource with a contract |
| Avoid | Stop the risky activity | Retire a legacy service instead of exposing it |
| Accept (retain) | Knowingly live with it, within appetite | Low impact risk with an approved exception |
Transfer moves the cost of a loss, not the accountability. The organization still answers to customers and regulators for its own data.
The risk register
A risk register lists each risk with its description, owner, ratings, chosen treatment, controls and review date. Every risk needs a named owner, since an unowned risk is not managed. The register is reviewed on a schedule and whenever the environment changes, for example after an acquisition or a new cloud service.
Key risk indicators (KRIs) are measurable signals that risk is rising, such as the number of unpatched critical systems. They give early warning between formal assessments.
Assessment frequency and scope
Risk assessments can be one time, such as before a project, or recurring on a schedule. Continuous approaches use live data from scanners and monitoring tools. Most mature programs combine scheduled reviews with event triggers such as a major incident or a new regulation.
What to remember for the exam
- Risk combines likelihood and impact.
- SLE equals asset value times exposure factor, and ALE equals SLE times ARO.
- Quantitative analysis uses money, qualitative analysis uses ranked categories.
- Residual risk is what is left after controls. Inherent risk is before controls.
- The four treatments are mitigate, transfer, avoid and accept.
- Transferring risk does not transfer accountability or reputational damage.
- A control is justified when ALE reduction exceeds its annual cost, unless a legal duty applies.
- Each register entry needs an owner, a rating, a treatment and a review date.
When a scenario asks for the best response, compare the cost of the control with the ALE before choosing mitigation.
Common mistakes
Calling insurance mitigation. Insurance reduces the financial impact for the organization, so it is transfer. Mitigation reduces likelihood or the size of the event itself.
Treating acceptance as ignoring. Acceptance is a documented decision by a person with authority, inside appetite.
Confusing appetite and tolerance. Appetite is the overall stance. Tolerance is the allowed deviation for a given objective.
Expecting zero residual risk. Some risk always remains, so the goal is residual risk within tolerance.
Using the wrong formula order. ALE needs SLE first. Multiplying asset value by ARO skips the exposure factor.
A very small ARO does not make a risk acceptable if the impact is catastrophic. Judge both factors together.
Check yourself
Work through these three questions.
An asset worth 100,000 has an EF of 40 percent and an ARO of 2. What is the ALE?
The SLE is 40,000, so the ALE is 80,000.
Buying cyber insurance is which risk treatment?
Transfer, because the financial impact moves to the insurer while accountability stays with the organization.
What does residual risk describe?
The risk that remains after controls are applied, which is compared with the organization's tolerance.
Topic 3 of 7 in Governance, Risk, and Compliance
Test yourself on Governance, Risk, and Compliance
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.