---
title: Missing the Mark on Risk Analysis Without ALE
description: A quick lesson in how to adjust your risk analysis to get a clearer picture of true loss exposure.
---

[The FAIR Institute Blog ](https://www.fairinstitute.org/blog)

# [Missing the Mark on Risk Analysis Without ALE](https://www.fairinstitute.org/blog/missing-the-mark-on-risk-analysis-without-ale)

 Written by [Chad Weinman](https://www.fairinstitute.org/blog/author/chad-weinman) | Aug 14, 2017 12:00:00 PM

Annualized Loss Exposure (ALE) is a key output from a [FAIR quantitative risk analysis](https://www.fairinstitute.org/why-fair). ALE is computed as:

**ALE = Event Frequency x Single Loss Magnitude**

Occasionally in industry, we observe organizations that more heavily focus on impact. If this is the case, take a look at the following table below

| **Asset** | **Effect** | **Type** | **Single Event Loss Magnitude (SLM)** |
| --- | --- | --- | --- |
| Customer Support Site | Availability | Malicious | $12,000 |
| eCommerce Database | Availability | Error | $246,000 |
| Order Process System | Availability | Error | $30,000 |
| Share Drives | Availability | Malicious | $80,000 |

The scenario above that looks the most significant to the organization is an outage of the  eCommerce Database. 

**But beware…**

If we are trying to prioritize by Risk, which means considering both Magnitude and Frequency:

| **Asset** | **Effect** | **Type** | **Single Event Loss Magnitude (SLM)** | **Event Frequency** | **ALE** |
| --- | --- | --- | --- | --- | --- |
| Customer Support Site | Availability | Malicious | $12,000 | 1 per year | $12,000 |
| eCommerce Database | Availability | Error | $246,000 | 1 every 10 years | $24,600 |
| Order Process System | Availability | Error | $30,000 | 4 per year | $120,000 |
| Share Drives | Availability | Malicious | $80,000 | 1 every 2 years | $40,000 |

We see the true prioritization has changed. 

In wrapping up - I am not advocating to stop communicating Single Loss Magnitude. Rather just telling a cautionary tale on forgetting about the true definition of risk, according to the FAIR standard. In reporting on risk, it is common for us to communicate both ALE as well as SLM. In doing so we are providing more information that could be valuable to key stakeholders.

Related: 

[What Exactly Is Loss Exposure](http://www.risklens.com/blog/what-exactly-is-loss-exposure)

[4 Most Forgotten Forms of Loss](https://www.fairinstitute.org/blog/4-most-forgotten-forms-of-loss-in-a-risk-analysis)

[View full post](https://www.fairinstitute.org/blog/missing-the-mark-on-risk-analysis-without-ale)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Chad Weinman"
  },
  "dateModified" : "2017-08-17T03:43:11.826Z",
  "datePublished" : "2017-08-14T12:00:00Z",
  "headline" : "Missing the Mark on Risk Analysis Without ALE",
  "image" : {
    "@type" : "ImageObject",
    "height" : 670,
    "url" : "https://cdn2.hubspot.net/hubfs/1616664/Blog%20Pictures/Stock%20Photos/missing-the-mark-with-ale.jpg",
    "width" : 1000
  },
  "mainEntityOfPage" : "https://www.fairinstitute.org/blog/missing-the-mark-on-risk-analysis-without-ale",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "FAIR Institute Blog"
  }
}
```