To senior management what is the primary factor in determining the size or existence of the asset protection program?

• A. Industry standards
• B. Cost-effectiveness
• C. Number of employees
• D. Annual budget availability

Answer: (B)

The primary factor is cost-effectiveness: management wants the asset protection program to deliver meaningful risk reduction relative to its cost. In practice this means a risk-based approach—assessing asset value, the likelihood and potential impact of threats, and the vulnerabilities that could be exploited. Then you compare the cost of controls and ongoing protection to the expected losses those controls would prevent (the cost of protection versus the expected annual loss if no protection were in place). If the investment yields a favorable return or a meaningful reduction in risk at a reasonable price, the program is sized or approved accordingly. Industry standards may set baselines, and budget limits can constrain what’s feasible, but the essential driver for deciding how large the program should be is whether the protection provides cost-effective risk reduction.