Certified in Risk and Information Systems Control (CRISC) — Question 623

The annualized loss expectancy (ALE) method of risk analysis:

Answer options

• A. uses qualitative risk rankings such as low, medium, and high
• B. can be used to determine the indirect business impact
• C. helps in calculating the expected cost of controls
• D. can be used in a cost-benefit analysis

Correct answer: D

Explanation

The correct answer, D, indicates that the ALE method can be integrated into a cost-benefit analysis to evaluate the financial implications of risks and controls. Options A, B, and C are incorrect because they refer to different aspects of risk management that do not specifically relate to the cost-benefit evaluation of risks.