Which of the following is the BEST evidence of a well-defined risk event?

Annual Loss Expectancy (ALE) quantifies a risk event’s expected financial impact and is derived from Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO).

CRISC guidance states:

“A well-defined risk event includes quantified impact analysis such as annual loss expectancy to facilitate prioritization and comparison.”

Chain-of-custody and KPIs are unrelated to defining risk events.

Hence, B is correct.

CRISC Reference: Domain 2 – IT Risk Assessment, Topic: Risk Quantification and Impact Analysis.