Home › Study Guides › SLE, ALE and ARO Calculator
SLE, ALE and ARO Calculator (Annualized Loss Expectancy)
SLE = asset value × exposure factor. That's the cost of one occurrence. ARO is how many times a year you expect it (once every 10 years = 0.1). ALE = SLE × ARO. That's the expected loss per year, which you compare with what a control costs per year.
Calculate SLE and ALE
Is the control worth it?
A control is financially justified when the yearly loss it removes is greater than what it costs per year. This uses the ALE from the calculator above as the "before" value.
Worked examples
Flooded server room
A $40,000 server would lose 25% of its value in a flood, expected once every 10 years.
SLE = $40,000 × 0.25 = $10,000
ARO = 1 ÷ 10 = 0.1
ALE = $10,000 × 0.1 = $1,000 per year
Repeated breaches
Each customer-data breach costs $250,000 in total. Three are expected every 10 years.
SLE = $250,000 (the cost per event is given)
ARO = 3 ÷ 10 = 0.3
ALE = $250,000 × 0.3 = $75,000 per year
Laptop theft
Laptops are worth $1,500 and are fully lost when stolen (EF 100%). Eight thefts happen per year.
SLE = $1,500 × 1.0 = $1,500
ARO = 8
ALE = $1,500 × 8 = $12,000 per year
Does the control pay off?
ALE is $60,000 (SLE $120,000, ARO 0.5). A $30,000-per-year control cuts the ARO to 0.1.
New ALE = $120,000 × 0.1 = $12,000
Loss removed = $60,000 − $12,000 = $48,000
Net benefit = $48,000 − $30,000 = $18,000 per year, so it's worth it.
Common traps on exam questions
- Turning "once every N years" into ARO: it's 1 ÷ N, so every 20 years is 0.05, not 20.
- Answering with the SLE: the SLE is the cost of one event. The question usually asks for the ALE, which is per year.
- Using EF twice: once the SLE is calculated, multiply only by the ARO.
- Skipping EF: multiplying the full asset value by the ARO assumes the asset is completely lost every time.
- Treating EF as a whole number: 25% is 0.25 in the formula.
- Forgetting the control's cost: a control is worth it only if the ALE it removes is greater than its yearly cost.
Practice: calculate the ALE
New numbers every time. Type your answer in dollars; the working appears after you check.
FAQ
What is the annualized loss expectancy formula?
ALE = SLE × ARO. The single loss expectancy (SLE) is asset value × exposure factor, and the annualized rate of occurrence (ARO) is how many times per year the event is expected.
How do you calculate ARO?
ARO is events per year. Something expected once every 10 years has an ARO of 0.1; something expected 4 times a year has an ARO of 4.
What is exposure factor?
Exposure factor is the percentage of an asset's value lost in one occurrence. A fire that destroys a quarter of a server room's value has an EF of 25%, or 0.25 in the formula.
How do I decide if a security control is worth it?
Compare the ALE before and after the control. If the reduction in ALE is greater than the control's annual cost, the control pays for itself on cost alone.
Are SLE, ALE and ARO on the Security+ exam?
Yes. CompTIA Security+ SY0-801 objective 5.2 lists single loss expectancy, annualized loss expectancy and annualized rate of occurrence as risk management concepts.