Question

A retailer's risk analyst is evaluating two data-related risks for the risk register. Risk A involves a rare but catastrophic breach of the entire customer database, estimated once every 20 years, with a loss of $10 million per occurrence. Risk B involves frequent minor payment-processing errors occurring about 40 times per year, each costing roughly $8,000. Management wants to know which risk should receive higher priority for treatment based on expected annual loss. Which conclusion should the analyst present?

Accepted Answer

Risk A should be prioritized because its annualized loss expectancy of $500,000 exceeds Risk B's annualized loss expectancy of $320,000

Answer

Risk B should be prioritized because its annualized loss expectancy of $320,000 is significantly higher than Risk A's $500,000... recalculated as lower

Answer

Risk A should be prioritized because its single-loss expectancy is far larger than any individual Risk B event

Answer

Risk B should be prioritized because its annualized loss expectancy ($320,000) is lower than Risk A's ($500,000), but frequency alone justifies treatment