Certified in Risk and Information Systems Control (CRISC) — Question 331

Which of the following can be used to assign a monetary value to risk?

Answer options

• A. Annual loss expectancy (ALE)
• B. Business impact analysis
• C. Cost-benefit analysis
• D. Inherent vulnerabilities

Correct answer: A

Explanation

Annual loss expectancy (ALE) is the metric that quantifies the potential financial loss associated with a specific risk over a year, making it the correct answer. Business impact analysis evaluates the effects of disruptions but does not assign a monetary value directly. Cost-benefit analysis compares costs and benefits of decisions but is not solely focused on risk valuation, while inherent vulnerabilities refer to weaknesses that may lead to risk but do not provide a monetary assessment.