What this lesson covers
Risk Management is 15% of the CSP blueprint, and the CSP expects you to rank risks with numbers and defend the spending that follows. Expected annual loss (EAL) is the simplest quantitative tool for that. This lesson gives you the method, shows how to compare controls with it, and covers where it misleads.
The formula
EAL = expected events per year x average loss per event
It turns every risk into one unit, dollars per year, so a frequent small loss and a rare large one can sit on the same list.
Getting the frequency right
Frequencies come in different forms. Convert each to events per year first.
| Given | Events per year |
|---|---|
| "Twice a year" | 2 |
| "Once every 20 years" | 1 / 20 = 0.05 |
| "A 1% chance in any year" | 0.01 |
| "About 3 times a month" | 36 |
Getting the loss right
Use the full average loss per event: direct costs (repairs, medical, wage replacement, fines) plus indirect costs (downtime, investigation, overtime, lost orders) when the question gives a basis for them. If a question says indirect costs are three times direct, a $20,000 direct loss becomes $80,000 in total.
Worked example: one risk
A loading dock has a forklift strike on a racking upright about once every two years. Each strike costs $18,000 in repairs and downtime. EAL = 0.5 x 18,000 = $9,000 a year.
Ranking several risks
Compute each EAL, then sort from largest to smallest.
| Risk | Events per year | Loss per event | EAL |
|---|---|---|---|
| Conveyor entanglement | 0.2 | $400,000 | $80,000 |
| Hand lacerations | 15 | $3,000 | $45,000 |
| Dust explosion | 0.004 | $25,000,000 | $100,000 |
| Vehicle collisions in the yard | 3 | $12,000 | $36,000 |
Ranked by EAL: dust explosion ($100,000), conveyor ($80,000), lacerations ($45,000), yard collisions ($36,000).
Notice what other rankings would say:
- By frequency: lacerations, collisions, conveyor, dust explosion. The most frequent risk is third by EAL.
- By severity: dust explosion, conveyor, collisions, lacerations.
Neither matches the EAL order. A question that asks for expected loss wants the product.
Comparing controls
A control's value is the EAL it removes minus what it costs each year (annualize capital costs over the control's life where the question asks).
Net annual benefit = EAL before - EAL after - annual cost of the control
Benefit-cost ratio = (EAL before - EAL after) / annual cost
Worked example: is the guard worth it?
The conveyor risk above has an EAL of $80,000. A guarding upgrade would cut the frequency from 0.2 to 0.05 a year and costs $25,000 a year (annualized).
The working (4 steps)
- EAL after = 0.05 x 400,000 = $20,000
- Reduction = 80,000 - 20,000 = $60,000
- Net annual benefit = 60,000 - 25,000 = $35,000
- Benefit-cost ratio = 60,000 / 25,000 = 2.4
Two controls together
When controls work on different parts of the risk, apply each to its own factor. A control that halves the frequency and another that cuts the loss per event by 40% leave 0.5 x 0.6 = 0.30 of the original EAL. Adding the percentages (50% + 40% = 90% removed) overstates the effect.
Where EAL misleads
- Catastrophic tails. Two risks with the same EAL are not equal if one could produce a single loss larger than the company can absorb. A $50,000 EAL made of 10 events of $5,000 is a budget line; a $50,000 EAL made of a 1-in-1,000 chance of a $50,000,000 loss is a threat to survival. Flag severity beside the EAL, and consider transferring the catastrophic part through insurance.
- Uncertain inputs. Rare-event frequencies are estimates. Show a range (low, likely, high) and check whether the ranking changes across it.
- Short track records. A year with no loss does not disprove an estimate. With 0.4 expected events a year, the chance of a loss-free year is about 0.67, so two years in three would look clean.
- Harm to people. EAL in dollars does not capture every value. Life-safety risks above the organization's tolerance get treated even when the money case is weak.
A five-step routine for exam questions
- Convert every frequency to events per year.
- Build the full loss per event from what the question gives.
- Multiply, then rank or compare.
- For controls, apply each control to the factor it changes, then subtract the control's annual cost.
- Check for a catastrophic tail or a life-safety issue that changes the answer.
Check yourself
Try the ten questions in the free practice set for this lesson. Each one gives every input you need.
Not affiliated with or endorsed by BCSP. CSP and BCSP are BCSP's marks and are used here only to name the exam.