Use an Annualized Loss Expectancy (ALE) method of risk analysis. This process was from the FIPS PUB 65, Guideline for Automatic Data Processing Risk Analysis. The write up went something like this:

The Annualized Loss Expectancy (ALE) is the expected monetary loss that can be expected for an asset due to a risk over a one year period. It is defined as: ALE = SLE * ARO where SLE is the Single Loss Expectancy and ARO is the Annualized Rate of Occurrence.

Why don’t we still use this form of analysis?