Quantitative Risk Assessment
Quantitative assessment deals with numbers and dollar amounts. It attempts to assign a cost (monetary value) to the elements of risk assessment and to the assets and threats of a risk analysis.
To fully complete a quantitative risk assessment, all elements of the process (asset value, impact, threat frequency, safeguard effectiveness, safeguard costs, uncertainty, and probability) are quantified. Therein lies the problem with purely quantitative risk assessment: It is difficult, if not impossible, to assign dollar values to all elements; therefore, some qualitative measures must be applied to quantitative elements. A quantitative assessment requires substantial time and personnel resources. The quantitative assessment process involves the following three steps:
- Estimate potential losses (SLE)
- Conduct a threat analysis (ARO)
- Determine annual loss expectancy (ALE)
Annual loss expectancy (ALE)
The expected value (cost) of a yearly occurrence of incidents of given type, in monetary units. It is a product of SLE and ARO (SLE*ARO). The ALE for each type of incident is different.
Annual rate of occurrence (ARO)
Expected number of an incident’s occurrences during a calendar year. For rare incidents, it is equivalent to a probability of one or more incidents during a year; for frequent incidents, it is equivalent to the expected number of incidents per year. The ARO for each type of incidents is different.
Gross margin
The difference between revenue and cost before accounting for certain other costs. Generally, it is calculated as the total selling price of the items sold (revenue), less the cost of goods sold (production or acquisition costs).
Overhead
The term here used for all costs borne by the entity besides the personnel costs.
Revenue (also called turnover)
The annual sum of all net invoices issued by a company, i.e. the total net price (without VAT) of all products sold during the fiscal year.
Single loss of expectancy (SLE)
The expected value (cost) of an incident in monetary units, assuming its single occurrence. The SLE for each type of incidents is different.
Total ALE (TALE)
The total expected annual loss expectancy from all types of incidents considered.
