For an information system, it is estimated that an incident causing a loss of 20 million yen each time occurs 0.1 times per year. A countermeasure costing 0.5 million yen per year would reduce the frequency to 0.02 times per year. What is the net annual benefit of this countermeasure (the reduction in expected loss minus the cost of the countermeasure)?

Answer: C. 1.1 million yen

The size of a risk can be compared using the expected loss per year (annualized loss expectancy), which is the loss per incident multiplied by the frequency. Before the countermeasure it is 20 million yen × 0.1 per year = 2 million yen per year; after it, 20 million yen × 0.02 per year = 0.4 million yen per year. The expected loss falls by 2 million − 0.4 million = 1.6 million yen, and subtracting the 0.5 million yen cost leaves a net benefit of 1.6 million − 0.5 million = 1.1 million yen. Because the net benefit is positive, the countermeasure can be judged worth its cost. Expected values alone, however, can understate incidents that are rare but catastrophic, so the size of the impact is considered as well.

• A. This subtracts the 0.5 million yen cost from the 2 million yen expected loss before the countermeasure, ignoring the 0.4 million yen expected loss that remains afterward.
• B. This is the reduction in expected loss, without subtracting the 0.5 million yen cost.
• C. Correct. The expected loss falls by 1.6 million yen; subtracting the 0.5 million yen cost gives 1.1 million yen.