What is ARO?
The annualized rate of occurrence (ARO) is the expected frequency of a specific risk event over one year. It is the second input to quantitative risk analysis. Single loss expectancy (SLE) prices one event, ARO says how many events to expect per year, and together they produce the annualized loss expectancy (ALE).
ALE = SLE × ARO
Converting scenario wording into ARO
ARO is always expressed as events per year, so the first step is to convert whatever frequency the scenario gives.
| The scenario says | ARO |
|---|---|
| Twice a month | 24 |
| Once a quarter | 4 |
| Once a year | 1 |
| Once every 4 years | 0.25 |
| Three times in the past 10 years | 0.3 |
| Once every 50 years | 0.02 |
For rare events, once every N years is an ARO of 1 divided by N. For frequent events, scale up to a full year: three incidents a month is an ARO of 36.
Where ARO figures come from
An ARO is an estimate based on the best history available: the organization's own incident and help desk records (how many laptops were reported lost last year, for example), insurance and actuarial data, industry breach reports, threat intelligence about attacks on similar organizations, and published hazard data. A building in a 100-year floodplain has about a 1 percent chance of that flood in any given year, so its ARO for the flood is about 0.01.
Thin data is the main weakness. Rare events such as a data center fire or a targeted intrusion have little history behind them, so their AROs are judgment calls, and the resulting ALE is only as good as that judgment.
ARO is a rate, not a probability
A probability cannot exceed 1, but an ARO can. An organization that loses 12 laptops a year has an ARO of 12 for laptop loss. For rare events the two are close, which is why an ARO of 0.05 is often described loosely as a 5 percent annual chance. Likelihood ratings such as possible or likely belong to qualitative analysis; ARO is a number used in the ALE formula.
ARO also differs from mean time between failures (MTBF). MTBF is the average running time between failures of a repairable component, such as a disk or power supply, and supports reliability and availability planning. ARO describes how often a risk event occurs and is used to price risk.
A worked ARO example
A regional office floods about three times every ten years, and each flood causes $150,000 in damage and downtime. The ARO is 3 ÷ 10 = 0.3, so the ALE is $150,000 × 0.3 = $45,000 a year. If flood barriers would cut the ARO to 0.1, the new ALE is $15,000, a $30,000 yearly reduction to weigh against the annual cost of the barriers.
A sanity check catches most mistakes. When the event happens less than once a year, the ARO is below 1, so the ALE must be smaller than the SLE. If your ALE comes out larger, you probably inverted the frequency.
ARO on the CompTIA Security+ exam
ARO is one of the quantitative risk measures under SY0-801 objective 5.2. Questions describe a frequency in words and expect you to turn it into events per year, then multiply by the SLE to get the ALE. The classic trap is inversion: once every 5 years is an ARO of 0.2, not 5, and the answer built on 5 is usually among the options. Other distractors include SLE, which is per event rather than per year, and MTBF, which is a hardware reliability metric rather than a risk frequency. If the question asks how often an event is expected each year, the answer is ARO.