Question

The information system of Carlsbad Bottle Inc. is deemed to be 90 percent reliable. A major threat in the procurement process has been discovered, with an exposure of $300,000. Two control procedure are identified to mitigate the threat. Implementation of control A would cost $18,000 and reduce the risk to 4 percent. Implementation of control B would cost $10,000 and reduce the risk to 6 percent. Implementation of both controls would cost $26,000 and reduce the risk to 2.5 percent. Given the information presented, and considering an economic analysis of costs and benefits only, which control procedure(s) should Carlsbad Bottle choose to implement?

Answer 1

There are three possible options available to Carlsbad bottle Inc.

i)Implement only control A ii) Implement only control B iii) Implement both control A and B

We need to calculate net benefit in each scenario by comparing cost with benefits.

i) Implementing only control A

Cost of control A = $18000. Benefit = Total exposure(Loss) * Risk reduction(100-4)% = $300000*96% = $288000

Hence net benefit = $288000 - $18000 = $270000

ii) Implementing only control B

Cost of control B = $10000. Benefit = $300000*94% = $282000

Hence net benefit = $282000 - $10000 = $272000

iii) Implementing both control A and B

Total cost = $26000. Benefit = $300000*97.50% = $292500

Net benefit = $292500 - $26000 = $266500

Hence option ii) of implementing only control B is to be done as it provides highest net benefit in comparison to all three options.