Annualized Loss Expectancy (ALE)

Annualized Loss Expectancy (ALE) is the expected monetary loss from a specific risk over one year. It is the product of two quantitative values: Single Loss Expectancy (SLE), the cost of one occurrence, and the Annualized Rate of Occurrence (ARO), the number of times per year the event is expected to happen. ALE = SLE x ARO. A laptop theft costing 4,000 with an ARO of 3 gives an ALE of 12,000.

The nuance is that ALE is a planning figure, not a prediction. An event with an ARO of 0.1 (once a decade) still produces an ALE every year, which is exactly what makes rare, expensive events comparable with frequent, cheap ones. ALE also drives cost justification: a control is financially sound when its annual cost is lower than the reduction in ALE it delivers, the difference between ALE before and ALE after the control is applied.

Exam relevance: if a scenario gives you SLE and ARO and asks for annual exposure, multiply them. If it asks which control to buy, pick the one whose yearly cost is below the ALE reduction it achieves, not simply the cheapest one. The confusable is SLE itself: SLE is the cost of a single event, ALE is that cost spread across a year, and questions quoting a per-incident figure are asking about SLE. Choosing a risk treatment without these numbers is qualitative, not quantitative, analysis.