3.2 Quantitative Assessment (SLE & ALE)

Theory: Quantitative Assessment (SLE & ALE)

The risk matrix (3.1) tells you that a risk is “High”, but a hospital’s finance director cannot put “High” into a budget. Quantitative risk assessment expresses risk in money: how much one incident would cost, and how much the organization should expect to lose per year. The classic method is Annualized Loss Expectancy (ALE); a more advanced family of methods is FAIR (Factor Analysis of Information Risk). This course uses the ALE calculation.

The Four Inputs

Term	Meaning	Unit
Asset Value (AV)	What the asset is worth to the organization (replacement cost, revenue it supports, value of the data)	Money (฿, USD)
Exposure Factor (EF)	The percentage of the asset’s value lost in one incident	0–100% (written as a decimal in calculations, e.g. 40% = 0.40)
Annualized Rate of Occurrence (ARO)	How many times per year the incident is expected to happen	Times per year
Single Loss Expectancy (SLE)	Money lost from one incident	Money
Annualized Loss Expectancy (ALE)	Expected money lost per year	Money per year

The Two Formulas

Single Loss Expectancy: the money lost from one incident.

$$\text{SLE} = \text{AV} \times \text{EF}$$

Annualized Loss Expectancy: the expected money lost per year.

$$\text{ALE} = \text{SLE} \times \text{ARO}$$

Combined: $\text{ALE} = \text{AV} \times \text{EF} \times \text{ARO}$.

Diagram loads as you scroll.

Reading ARO Correctly

ARO is a rate per year, so events that happen less than once a year have an ARO below 1:

Expected frequency	ARO
Four times a year	4
Once a year	1
Once every 2 years	0.5
Once every 4 years	0.25
Once every 10 years	0.1

In general, if an incident happens once every $n$ years, $\text{ARO} = 1/n$.

Common mistakes:

• Using EF as a whole number. 40% must be entered as $0.40$, not 40.
• Writing “once every 2 years” as ARO = 2. It is $1/2 = 0.5$. ARO = 2 would mean twice a year.
• Confusing SLE and ALE. SLE is the cost of one incident; ALE is the expected cost per year. If ARO is below 1, ALE is smaller than SLE; if ARO is above 1, ALE is larger.

Worked Example from the Slides: The EHR System

MediCare Plus’s Electronic Health Records (EHR) system is valued at ฿10,000,000. A successful attack is expected to destroy or compromise 40% of that value, and such an attack is expected once every 2 years.

Input / Output	Value
Asset Value	฿10,000,000
Exposure Factor	40% (0.40)
SLE	$10{,}000{,}000 \times 0.40 = 4{,}000{,}000$ → ฿4,000,000
ARO	0.5 (once every 2 years)
ALE	$4{,}000{,}000 \times 0.5 = 2{,}000{,}000$ → ฿2,000,000 per year

What ALE Is Used For

ALE is the number a CFO wants to see before approving a large security budget request. It lets management compare the cost of a risk with the cost of treating it, in the same unit (money per year):

• If a control costs much less per year than the loss it prevents, it is easy to justify.
• If the control costs more than the loss it prevents, it is hard to justify, and Accept (see 3.3) may be the sensible choice, unless law or regulation requires treatment anyway.

ALE also gives a precise ranking of risks: the asset with the larger ALE is the bigger expected yearly loss.

A quantitative result is more objective, but only as good as its inputs. Asset values, EF and ARO are themselves estimates. Like a qualitative score, each estimate should be justified with evidence (loss history, incident reports, how exposed the asset is).

Qualitative vs. Quantitative, Side by Side

	Qualitative	Quantitative
Objective / purpose	Quickly prioritize risks for action	Justify a budget with a money cost of risk
Basis of scoring	Judgment and experience (ordinal 1–5 scale)	Data and statistical estimates (monetary)
Output	Risk level: Low / Medium / High / Critical	Expected loss per year, e.g. ALE = ฿2,000,000
Data required	Minimal: expert judgment is enough	Asset values, loss history, occurrence rates
Speed and effort	Fast, low effort	Slower: real effort to gather reliable data
Precision	Approximate, more subjective	More objective, but only as good as its inputs
Best used for	Routine risk triage, day-to-day decisions	High-stakes investment cases, executive/board reporting
Tool in this course	The risk matrix (3.1)	The SLE / ALE calculation

In the exam, show the formula, the substitution and the result for every calculation (e.g. “SLE = AV × EF = 5,000,000 × 0.6 = 3,000,000”). Then state in words what the number means (“the hospital should expect to lose about ฿900,000 per year from this risk”).

---

Worked Examples

The questions below complete the MediCare Plus Quantitative Risk Assessment Worksheet. Row 1 (EHR) was worked above; rows 2–5 follow.

#	Asset	Asset Value	EF	ARO
1	Electronic Health Records (EHR) System	฿10,000,000	40%	0.5
2	Networked Medical Devices (infusion pumps, monitors)	฿5,000,000	60%	0.3
3	Financial / Insurance Billing System	฿3,000,000	50%	0.4
4	Staff & Professional Licensing Database	฿800,000	30%	0.6
5	Guest / Patient Wi-Fi Network	฿200,000	20%	0.2

Exercise 1

(Worksheet row 2) Calculate the SLE and ALE for Networked Medical Devices (Asset Value ฿5,000,000, EF 60%, ARO 0.3).

Show solution ↓Hide solution ↑

Solution

Step 1: SLE. Convert EF to a decimal: 60% = 0.60.

$$\text{SLE} = \text{AV} \times \text{EF} = 5{,}000{,}000 \times 0.60 = 3{,}000{,}000$$

One incident costs ฿3,000,000.

Step 2: ALE. An ARO of 0.3 means the incident is expected about 3 times in 10 years.

$$\text{ALE} = \text{SLE} \times \text{ARO} = 3{,}000{,}000 \times 0.3 = 900{,}000$$

SLE = ฿3,000,000; ALE = ฿900,000 per year. Check: $5{,}000{,}000 \times 0.6 \times 0.3 = 900{,}000$ ✓

Exercise 2

(Worksheet row 3) Calculate the SLE and ALE for the Financial / Insurance Billing System (Asset Value ฿3,000,000, EF 50%, ARO 0.4).

Show solution ↓Hide solution ↑

Solution

Step 1: SLE. 50% = 0.50.

$$\text{SLE} = 3{,}000{,}000 \times 0.50 = 1{,}500{,}000$$

Step 2: ALE.

$$\text{ALE} = 1{,}500{,}000 \times 0.4 = 600{,}000$$

SLE = ฿1,500,000; ALE = ฿600,000 per year. Check: $3{,}000{,}000 \times 0.5 \times 0.4 = 600{,}000$ ✓

Exercise 3

(Worksheet row 4) Calculate the SLE and ALE for the Staff & Professional Licensing Database (Asset Value ฿800,000, EF 30%, ARO 0.6).

Show solution ↓Hide solution ↑

Solution

Step 1: SLE. 30% = 0.30.

$$\text{SLE} = 800{,}000 \times 0.30 = 240{,}000$$

Step 2: ALE.

$$\text{ALE} = 240{,}000 \times 0.6 = 144{,}000$$

SLE = ฿240,000; ALE = ฿144,000 per year. Check: $800{,}000 \times 0.18 = 144{,}000$ ✓

Exercise 4

(Worksheet row 5) Calculate the SLE and ALE for the Guest / Patient Wi-Fi Network (Asset Value ฿200,000, EF 20%, ARO 0.2).

Show solution ↓Hide solution ↑

Solution

Step 1: SLE. 20% = 0.20.

$$\text{SLE} = 200{,}000 \times 0.20 = 40{,}000$$

Step 2: ALE. ARO 0.2 means about once every 5 years.

$$\text{ALE} = 40{,}000 \times 0.2 = 8{,}000$$

SLE = ฿40,000; ALE = ฿8,000 per year. Check: $200{,}000 \times 0.04 = 8{,}000$ ✓

Exercise 5

(Worksheet reflection 1 and 2) Using the ALE figures for all five rows, rank the assets from highest to lowest priority for security investment. Would you expect this ranking to match a qualitative risk-matrix ranking of the same assets? Where might they disagree, and why?

Show solution ↓Hide solution ↑

Solution

Step 1: Collect the ALE values.

#	Asset	SLE	ALE (per year)	Priority
1	EHR System	฿4,000,000	฿2,000,000	1
2	Networked Medical Devices	฿3,000,000	฿900,000	2
3	Billing System	฿1,500,000	฿600,000	3
4	Licensing Database	฿240,000	฿144,000	4
5	Guest / Patient Wi-Fi	฿40,000	฿8,000	5

Ranking by ALE: EHR (฿2,000,000) → Medical Devices (฿900,000) → Billing (฿600,000) → Licensing DB (฿144,000) → Guest Wi-Fi (฿8,000).

Step 2: Compare with the qualitative ranking. The two methods will broadly agree at the extremes: the EHR near the top and the guest Wi-Fi at the bottom. Disagreements are most likely in the middle, for example:

• Networked medical devices may be scored Critical on the risk matrix, possibly above the EHR, because a tampered infusion pump can harm patients (Impact 5, Severe). ALE only counts money, so it cannot fully capture harm to people, legal liability or loss of trust.
• Billing may rank higher qualitatively if the group weighs PDPA penalties and reputation damage, which are hard to price.
• Ties on the matrix (two assets both “High”) are broken by ALE, because money figures are finer-grained than four risk levels.

They disagree because the qualitative method rests on judgment about every kind of harm, while the quantitative method rests on monetary estimates that are only as good as their inputs. Use both: the matrix for fast triage, ALE to justify spending.

Exercise 6

(Mini-case) An attack on MediCare Plus’s pharmacy inventory system (valued at ฿2,000,000) is expected once every 4 years and would wipe out 25% of the system’s value. A vendor offers a protection package for ฿150,000 per year that would almost eliminate this risk. Calculate the ALE and advise whether the package is financially justified.

Show solution ↓Hide solution ↑

Solution

Step 1: Convert the inputs. EF = 25% = 0.25. “Once every 4 years” gives $\text{ARO} = 1/4 = 0.25$.

Step 2: SLE.

$$\text{SLE} = 2{,}000{,}000 \times 0.25 = 500{,}000$$

Step 3: ALE.

$$\text{ALE} = 500{,}000 \times 0.25 = 125{,}000$$

Step 4: Compare. The package costs ฿150,000 per year but prevents at most ฿125,000 of expected loss per year. Treatment costs more than the loss it prevents.

ALE = ฿125,000 per year, so on cost alone the ฿150,000 package is not justified. Management should look for a cheaper control or accept and monitor the risk, unless a legal or regulatory requirement (or patient-safety concern) makes treatment mandatory regardless of cost.