The Return on Investment (ROI) measurement used in Information Technology and Information Security fields is typically calculated with which formula?

ROI = (gain - expenditure) / expenditure x 100% is the correct formula because subtracting expenditure from gain isolates the net benefit, dividing by expenditure normalizes it relative to the original investment size, and multiplying by 100 converts the ratio to a percentage. This allows direct comparison of returns across investments of different scales, which is essential for IT security budget justification.

Adding gain and expenditure in the numerator counts costs as a contributor to return, inflating the result and producing a figure with no recognized financial meaning.

Substituting 'loss' for 'gain' and adding expenditure in the numerator produces a metric that measures negative outcomes compounded by cost, not a return on investment.

Using 'loss' minus expenditure results in a double-negative biased figure that does not correspond to any recognized ROI definition in finance, IT, or security frameworks.