To estimate the losses likely to occur when a threat is realized or a vulnerability is exploited, which of the following loss categories allow management the best means to estimate their potential losses? a) Single occurrence loss, actual loss b) Expected loss, catastrophic loss c) Catastrophic loss, actual loss d) Expected loss, single occurrence loss Solution d. Two loss categories are usually identified, including (i) losses caused by threats with reasonably predictable occurrence rates, referred to as expected losses expressed as dollars per year and are computed as the product of occurrence rate, loss potential, and vulnerability factor, and (ii) losses caused by threats with a very low rate of occurrence (low-probability) that is difficult to estimate but the threat would cause a very high loss if it were to occur (high- consequence risk), referred to as a single occurrence loss and is expressed as the product of loss potential, vulnerability factor, and asset value..