Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A firm estimates a cyber event that compromises customer data has an annual probability of 4%, and a loss of USD 25 million if it occurs. A proposed control costing USD 600,000 a year would cut the probability to 1.5% and leave the loss severity unchanged. What is the net annual benefit of the control, based on expected loss?

The net annual benefit is USD 25,000. Expected loss falls from USD 1.0 million (4% of 25 million) to USD 375,000 (1.5%), a saving of USD 625,000, and subtracting the USD 600,000 annual control cost leaves USD 25,000.

  1. AUSD 25,000Correct
  2. BUSD 400,000
  3. CUSD 625,000
  4. DUSD 1,000,000

Explanation

Expected loss before = 0.04 x 25m = USD 1.0m. After = 0.015 x 25m = USD 0.375m. Reduction = USD 0.625m. Net of the USD 0.6m cost = USD 25,000. USD 625,000 ignores the cost; USD 400,000 is a mistaken subtraction.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions