Neco 2019 Data Processing Question 33

A company faces two types of security breaches. Without any controls, the probability of an external breach in a year is \(0.12\) and the expected loss from such a breach is \(\text{₦}5{,}000{,}000\). The probability of an insider breach is \(0.08\) with an expected loss of \(\text{₦}3{,}000{,}000\).\nThree controls are available:\n1. Firewall: reduces the external breach probability from \(0.12\) to \(0.04\).\n2. Intrusion Detection System (IDS): reduces the external breach probability from \(0.04\) to \(0.015\).\n3. Employee training: reduces the insider breach probability from \(0.08\) to \(0.02\).\nAssuming the two breach types are independent, if the company implements the firewall and employee training but **not** the IDS, calculate:\n(i) the expected annual loss, and\n(ii) the percentage reduction in expected loss compared with having no controls.