90% probability of compliance vs. 10% of not
Non-compliance will cost us $10mil
Cost risk = 10% of $10mil = $1mil
If we verify, we will reduce the loss to $1mil
If non-compliant
cost risk = 10% of $1mil = $100k
So risk reduction = $900k
Any verification costing less than $900k that, with certainty, would detect non-compliance would add value.
If there is uncertainty of the verification activity discovering the non-compliance, say 50% probability, we would be justified in spending up to 50% of $900k; 10%: 10% of $900k, etc.
