A business case rests entirely on a single annualized loss expectancy figure, and executives question how reliable that number is. What should the security manager do?
Select an answer to reveal the explanation.
Short Explanation
A single dollar figure looks precise, but it's built on guesses about how often and how badly things go wrong. Show your assumptions, give a range instead of one number, and back it up with qualitative judgment. The trap is defending the formula as if math makes the inputs true.
Full Explanation
Annualized loss expectancy is calculated from estimates of single loss expectancy and annual rate of occurrence, and both inputs are often uncertain, particularly for rare, high-impact events. Presenting one figure as the sole justification overstates precision and invites exactly the challenge the executives raised. The appropriate response is to make the assumptions explicit, express the estimate as a range that reflects uncertainty, and supplement it with qualitative analysis of impacts such as reputation, regulatory consequences and strategic effects that are hard to quantify. This makes the case more credible, not less. Inflating the estimate to secure approval is unethical and, once discovered, destroys the credibility of the security function. Removing the financial analysis and relying solely on regulation discards useful information and only works if the investment is actually mandated, which the scenario does not state. Defending the figure as precise because the formula is recognized confuses a valid calculation with valid inputs; a correct formula applied to uncertain inputs still yields an uncertain result. Exam caveat: quantitative analysis remains valuable for comparing options when inputs are reasonable; the issue is presenting it as more certain than it is. Operational check: confirm the revised case documents each input's source and range and includes a qualitative impact assessment.