Mitigation strategies must be evaluated for economic efficiency to ensure that control costs do not exceed the value of the protection they provide. Risk teams calculate the Return on Control Investment (ROCI) to assess the financial impact of proposed mitigation plans.
To calculate the net financial impact of a proposed control, risk analysts use the Annualized Loss Expectancy (ALE) formula:
ALE Baseline = Annualized Rate of Occurrence * Single Loss Expectancy
Net Control Benefit = ALE Baseline - ALE Mitigated - Annual Cost of Control
Where:
- Annualized Rate of Occurrence (ARO) = The expected frequency of the risk event within a single year.
- Single Loss Expectancy (SLE) = The total estimated financial impact of a single occurrence of the risk event.
- ALE Baseline = The total annual loss exposure of the unmitigated risk process.
- ALE Mitigated = The remaining annual loss exposure expected after the new control is implemented.
- Annual Cost of Control = The total cost to implement and operate the control annually (including software licenses, hardware maintenance, and staff hours).
If the net control benefit is negative, it indicates that the mitigation plan costs more than the expected reduction in risk exposure. In these cases, the organization should evaluate alternative risk strategies, such as modifying the core process design, transferring the risk via insurance, or formally accepting the risk within corporate tolerance boundaries.