Quality Risk, Reliability and Cost Economics

Introduction

Project quality management is often presented as conformance to requirements, but advanced practice requires a broader question: how should a project allocate limited resources among uncertain threats, reliability objectives, preventive controls, inspections, and the consequences of failure? Quality risk, reliability, maintainability, resilience, and cost economics provide an integrated answer.

A quality risk is the effect of uncertainty on the achievement of quality objectives. It may arise from design ambiguity, process variation, supplier failure, human error, cybersecurity weakness, inadequate testing, or an external hazard. Risk-based quality management does not mean accepting poor quality at lower cost. It means directing controls toward the failure modes that matter most, while recognizing that prevention is usually less expensive and more socially responsible than correction after harm has occurred.

Reliability concerns the probability that an item or system performs its required function for a stated time under stated conditions. Maintainability concerns the ease and speed with which it can be restored. Resilience concerns the capability to absorb disruption, adapt, and recover while maintaining essential functions. These concepts are related but not interchangeable. A highly reliable system may still be difficult to repair; a maintainable system may recover quickly but fail frequently; a resilient organization may continue operating despite failures through redundancy and adaptive response.

The economic dimension is captured by the cost of quality: prevention costs, appraisal costs, internal failure costs, and external failure costs. The manager's objective is not simply to minimize inspection expenditure. It is to minimize total expected cost while meeting contractual, regulatory, ethical, safety, and strategic obligations.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain risk-based thinking and distinguish hazards, risks, issues, controls, and residual risk.
2. Apply FMEA and hazard-analysis methods to identify and prioritize quality risks.
3. Calculate and interpret reliability, failure rate, maintainability, availability, and basic system-reliability measures.
4. Explain how resilience complements reliability and business continuity.
5. Classify quality-related expenditure into prevention, appraisal, internal failure, and external failure costs.
6. Evaluate quality investments using expected-cost, break-even, and life-cycle reasoning.
7. Design governance and improvement responses that balance cost, performance, safety, and stakeholder expectations.

1. Risk-Based Thinking in Quality Management

Risk-based thinking embeds uncertainty analysis in planning, design, procurement, execution, verification, and closeout. It replaces the assumption that all defects deserve the same response with a structured assessment of likelihood, consequence, detectability, exposure, and controllability.

Important distinctions are as follows:

• Hazard: a condition or source with the potential to cause harm.
• Risk: the effect of uncertainty, often described through likelihood and consequence.
• Cause: a condition that can produce a failure.
• Failure mode: the way a process, component, or deliverable fails to meet a requirement.
• Effect: the consequence of a failure mode.
• Control: a measure that prevents a cause, detects a failure, reduces its consequence, or supports recovery.
• Inherent risk: exposure before controls.
• Residual risk: exposure remaining after controls.
• Issue: a risk that has materialized and requires action.
• Opportunity: uncertainty that may produce a beneficial outcome.

A simple expected-loss model is useful for prioritization:

Here, pᵢ is the probability of outcome i, Cᵢ is its consequence in monetary or other consistent units, and EL is expected loss. The model assumes that outcomes are sufficiently defined and that probability and consequence estimates are meaningful. It is not a complete decision rule where safety, legal duties, equity, or catastrophic consequences cannot be represented adequately by money.

For a control with cost C_c that reduces expected loss from EL_before to EL_after, the expected monetary value of the control is:

A positive value supports adoption on economic grounds, but a negative value does not justify violating law, safety requirements, or professional ethics. Probability ranges, sensitivity analysis, and scenario analysis should be used where estimates are uncertain.

Risk registers should record the risk statement, causes, affected objectives, owner, inherent rating, existing controls, planned response, trigger conditions, residual rating, due date, and evidence of control effectiveness. A risk score can support screening, but it should not replace judgment. Multiplying ordinal scores for likelihood and consequence creates a ranking device, not a probability model.

2. FMEA: Structured Failure-Mode Reasoning

Failure Modes and Effects Analysis (FMEA) is a bottom-up method. The team examines functions, identifies possible failure modes, determines causes and effects, evaluates existing controls, and assigns actions. It is particularly useful during design, process development, equipment selection, commissioning, and change control.

A conventional FMEA uses three ratings, commonly on a 1–10 scale:

• Severity (S): seriousness of the effect if failure occurs.
• Occurrence (O): likelihood or frequency of the cause or failure.
• Detection (D): likelihood that current controls will fail to detect the failure before release or use. A high score means poor detectability.

The traditional Risk Priority Number is:

The ratings are ordinal, not necessarily interval-scale measurements. Therefore an RPN of 200 is not objectively twice as risky as an RPN of 100, and different combinations can produce the same RPN. A low-frequency catastrophic failure may deserve priority even when its RPN is lower than that of a frequent minor defect. Modern practice supplements or replaces RPN with action-priority rules, severity gates, criticality analysis, and explicit safety or regulatory thresholds.

A concise FMEA record includes:

The quality of an FMEA depends more on team composition and evidence than on the spreadsheet. Design engineers, operators, maintainers, quality specialists, suppliers, safety professionals, and users may identify different failure mechanisms. Historical defect data, field returns, test results, near misses, and lessons learned should inform ratings. Actions should address causes at their source: redesign, interlock, poka-yoke, material substitution, supplier qualification, or process control are generally stronger than relying solely on inspection.

3. Hazard Analysis and Critical Controls

Hazard analysis begins with credible sources of harm and asks how harm can be prevented or mitigated. It is essential in construction, energy, healthcare, aerospace, food, chemicals, transportation, and cybersecurity-enabled systems.

A typical hazard-analysis sequence is:

1. Define system boundaries, intended use, interfaces, and operating environments.
2. Identify hazards, hazardous events, initiating causes, and vulnerable stakeholders.
3. Estimate likelihood and consequence using evidence and conservative assumptions.
4. Identify preventive, detective, protective, and recovery controls.
5. Allocate controls according to the hierarchy of controls: eliminate, substitute, engineer, administratively control, and use personal protective equipment where relevant.
6. Verify controls through inspection, test, simulation, audit, or demonstration.
7. Monitor leading indicators, triggers, incidents, and changes.

Fault Tree Analysis (FTA) is a top-down method. It starts with a defined undesired event and decomposes it using logical gates. For independent events A and B, an AND gate occurs only when both occur:

For an OR gate, the top event occurs when either occurs:

If A and B are independent, this becomes P(A ∪ B) = P(A) + P(B) − P(A)P(B). Independence must not be assumed where common-cause failures, shared utilities, correlated human actions, or environmental conditions exist.

Event Tree Analysis (ETA) starts with an initiating event and follows successful or failed protective functions to calculate possible outcomes. FMEA, FTA, and ETA are complementary: FMEA is usually bottom-up, FTA top-down, and ETA consequence-oriented. Bow-tie analysis links a central hazard to preventive barriers on the left and mitigating barriers on the right.

4. Reliability Engineering for Projects

4.1 Reliability function and failure rate

For a non-repairable item, reliability at time t is the probability of surviving without failure to time t:

T is the random time to failure and F(t) is its cumulative failure distribution. The failure-rate or hazard-rate function is:

where f(t) is the probability-density function. The units of λ(t) are inverse time, such as failures per operating hour. Reliability and failure rate are distinct: reliability is a survival probability, whereas failure rate is an instantaneous conditional rate.

For a constant failure rate λ, the exponential model applies:

This model assumes a constant hazard rate and is often reasonable during a useful-life period, but it is inappropriate for infant mortality or wear-out unless those behaviors are separately modeled. The mean time to failure under the exponential model is:

For example, if λ = 0.0002 failures per operating hour, then MTTF = 5,000 hours. Reliability after 1,000 hours is R(1000) = e^(−0.0002×1000) = e^(−0.2) ≈ 0.819, or approximately 81.9%.

The bathtub curve is a conceptual representation of three periods: decreasing failure rate from early defects, approximately constant random failure rate, and increasing failure rate caused by wear-out. It is not a universal law; the curve depends on technology, maintenance, environment, and data quality.

4.2 Series and parallel systems

For a series system, every component must function. If component failures are independent:

For two components, each with reliability 0.98, R_s = 0.98 × 0.98 = 0.9604. The system is less reliable than either component.

For two independent, active parallel components, the system works if at least one works:

With two components each having reliability 0.98, R_p = 1 − (0.02)(0.02) = 0.9996. The calculation assumes genuinely independent failures and adequate switching, capacity, power, and maintenance. Redundancy can create common-cause vulnerabilities if components share software, cooling, suppliers, or operators.

4.3 Maintainability and availability

Maintainability is the probability that a failed item can be restored within time t under stated conditions. With a constant repair rate μ, the exponential repair model is:

Here μ has units of repairs per unit time and assumes a constant repair rate, independent repair processes, available resources, and a clearly defined restoration boundary.

For a continuously operated repairable system with constant failure rate and repair rate, steady-state inherent availability is:

MTBF is mean time between failures and MTTR is mean time to repair. If MTBF = 900 hours and MTTR = 10 hours, A_i = 900/910 ≈ 0.989, or 98.9%. Operational availability may be lower because it includes logistics delay, preventive maintenance, staffing, spare-part delays, and administrative time. Definitions must be stated before comparing projects or suppliers.

4.4 Reliability allocation and testing

Reliability allocation distributes a system target among subsystems. In a series system, multiplying component reliabilities means that each component consumes part of the system reliability budget. Allocation may consider complexity, maturity, duty cycle, environment, criticality, and improvement cost.

Reliability demonstration tests must specify confidence, test duration, acceptance criteria, censoring rules, and the assumed failure distribution. A zero-failure test does not prove zero probability of failure. Statistical claims require explicit confidence levels and assumptions. Accelerated testing can reduce time but may change failure mechanisms if temperature, vibration, voltage, or load is increased beyond physically representative conditions.

5. Resilience and Quality under Disruption

Reliability aims to prevent failure; resilience addresses the ability to continue or recover when prevention is insufficient. Resilience includes anticipation, monitoring, response, adaptation, and learning. Project quality plans should therefore address not only defect prevention but also graceful degradation, emergency procedures, alternate suppliers, data backup, manual workarounds, recovery objectives, and post-event learning.

A resilient design may include independent utilities, geographically diverse suppliers, tested failover, modular architecture, cross-trained personnel, and transparent escalation. However, redundancy introduces cost and may increase system complexity. Resilience should be evaluated against plausible disruption scenarios rather than treated as an abstract score.

Two important continuity measures are:

• Recovery Time Objective (RTO): maximum acceptable time to restore a service or function.
• Recovery Point Objective (RPO): maximum acceptable data loss measured in time.

Quality governance should distinguish recovery from restoration to original conditions. Adaptation may produce a new operating mode that is safe and acceptable even if it differs from the original design.

6. The Economics of Quality

The cost of quality is the cost of achieving quality plus the cost arising when quality is not achieved. The conventional categories are:

The accounting boundary must be stated. Some organizations classify quality engineering as prevention; others classify part of it as project overhead. The purpose is managerial visibility, not a universal chart of accounts.

A basic identity is:

where C_p is prevention cost, C_a appraisal cost, C_if internal failure cost, and C_ef external failure cost. This identity is an accounting classification, not a claim that all quality consequences can be measured precisely.

The optimal quality investment is often a minimum of total cost, not a point of zero defects achieved at any price. More prevention and appraisal generally reduce failure costs, but the relationship may be nonlinear and may exhibit diminishing returns. The economically relevant question is incremental:

If a control increases control cost by ΔC_control and changes failure cost by ΔC_failure, it is attractive when ΔTC < 0, subject to safety, legal, and ethical constraints.

Worked economic example

A project expects 1,000 units. Without an additional prevention program, the estimated defect rate is 4%, and each defective unit costs $600 in rework or failure consequences. The expected failure cost is:

1,000 × 0.04 × $600 = $24,000.

A supplier-development program costs $9,000 and is expected to reduce the defect rate to 1%. The remaining expected failure cost is 1,000 × 0.01 × $600 = $6,000. Total cost with the program is $15,000, compared with $24,000 without it. The expected saving is $9,000, exactly equal to the program cost; the net expected monetary benefit is therefore $0.

This is a break-even estimate, not a reason to reject the program automatically. If the failure could cause injury, regulatory breach, strategic customer loss, or severe reputational damage, adoption may be required despite zero direct expected saving. Conversely, if the defect estimates are uncertain, sensitivity analysis is necessary. At a 2% post-program defect rate, total cost becomes $21,000, and the program saves only $3,000; at a 0.5% rate, total cost becomes $12,000, and saving is $12,000.

External failure costs should include consequential effects where defensible: field labor, transport, replacement, contractual penalties, lost contribution margin, investigation, notification, legal exposure, and stakeholder trust. Intangible costs should not be assigned false precision; scenario ranges and qualitative judgments may be more credible.

7. Integrating Risk, Reliability, and Cost Decisions

A mature quality investment process follows these steps:

1. Define the required performance, safety, regulatory, and customer outcomes.
2. Identify failure modes, hazards, dependencies, and disruption scenarios.
3. Estimate likelihood, severity, detectability, reliability, recovery time, and uncertainty.
4. Compare prevention, appraisal, redundancy, maintenance, monitoring, and recovery alternatives.
5. Calculate expected and life-cycle costs, including residual risk and control-maintenance costs.
6. Test sensitivity to key assumptions and identify catastrophic or irreversible outcomes.
7. Select controls using the hierarchy of controls and the strongest feasible design measures.
8. Assign ownership, verification evidence, leading indicators, and escalation thresholds.
9. Reassess after design changes, incidents, supplier changes, and new operating evidence.

Life-cycle cost is broader than acquisition cost. A simplified expression is:

C₀ is initial cost, C_op,t operating cost in period t, C_m,t maintenance cost, C_f,t failure cost, C_d,t disposal or decommissioning cost, S_n residual or salvage value at period n, and r is the discount rate per period. Costs and benefits must be expressed in the same currency and time basis. The formula assumes deterministic estimates; stochastic life-cycle models should use expected values or simulation and should disclose distributional assumptions.

Optimization must also consider the value of information. A test, pilot, audit, or prototype may be worthwhile because it reduces uncertainty before an irreversible commitment. The decision value is not merely the test result; it is the improvement in later decisions minus test cost and delay.

8. Illustrative Case: Reliability Risk in a Hospital Expansion Project

Background

This illustrative case concerns a project to expand a hospital's imaging department. The project includes a high-capacity electrical system, cooling equipment, network connectivity, and a magnetic-resonance imaging service. Quality requirements include patient safety, diagnostic availability, data integrity, regulatory compliance, and continuity of urgent care.

Problem

The initial design met nominal capacity requirements but depended on one cooling unit, one network switch, and a single specialist supplier. A workshop identified three high-consequence failure modes: loss of cooling causing equipment shutdown, network interruption preventing image transfer, and supplier delay preventing replacement of a critical component.

Analysis

The team performed FMEA and fault-tree analysis. The original design had high severity for all three modes. A conventional RPN ranking placed a frequent minor documentation error above the cooling failure, but the team used a severity gate to ensure that patient-safety and service-continuity risks received priority. Reliability calculations showed that two independent cooling units in active standby would substantially improve availability, but only if they had separate power feeds and automatic switchover. The team also discovered that both proposed units used the same control board, creating common-cause risk.

The cost team compared four alternatives: no change, a second cooling unit with shared controls, fully independent cooling with tested failover, and independent cooling plus a spare control board and service agreement. The comparison included acquisition, commissioning, preventive maintenance, downtime, and patient rescheduling. Although the fourth option had the highest initial cost, its expected life-cycle cost was lower under realistic disruption scenarios.

Approach and solution

The approved controls were:

• two cooling trains with independent power and control paths;
• quarterly failover tests witnessed by operations and quality personnel;
• network-path redundancy with documented recovery procedures;
• a qualified alternate supplier and locally held critical spare;
• an RTO for imaging service and a tested manual scheduling procedure;
• leading indicators for alarm frequency, overdue maintenance, spare availability, and failed failover tests;
• a change-control rule requiring renewed hazard analysis after software, supplier, or equipment changes.

Outcome

During commissioning, a failover test revealed that the standby cooling unit started but did not reach required flow within the specified time. The defect was corrected before clinical operation. A purely inspection-based strategy would have checked installation conformance but might not have exposed the dynamic failure. The project achieved the required service-availability target without treating redundancy as sufficient evidence by itself.

Learning points

The case demonstrates five principles. First, reliability is a system property, not merely a component specification. Second, common-cause failures can defeat apparent redundancy. Third, dynamic testing is essential for failover and recovery controls. Fourth, life-cycle cost can justify a higher initial investment. Fifth, severity, ethics, and continuity requirements can override a narrow RPN or lowest-price decision.

9. Governance, Ethics, and Contemporary Practice

Quality-risk decisions have governance implications. Project leaders should preserve traceability from requirement to risk, control, verification evidence, acceptance decision, and operational owner. Independent review is appropriate for high-hazard systems, safety-critical software, medical products, infrastructure, and projects with significant public consequences.

Ethical practice requires truthful reporting of defects, transparent assumptions, protection of users and workers, and escalation of unacceptable residual risk. A manager must not manipulate ratings to make a project appear safer or conceal external failure costs by transferring them to customers or communities. Procurement decisions should consider supplier labor practices, counterfeit risk, cybersecurity, environmental effects, and continuity exposure.

Artificial intelligence can support anomaly detection, predictive maintenance, document analysis, and pattern discovery across defect records. However, AI outputs require validated data, explainable thresholds, human accountability, cybersecurity controls, and monitoring for drift. A predictive model may identify correlation without identifying cause; it must not replace hazard analysis or professional responsibility. Automated inspection can also create false confidence when training data omit rare but severe failures.

Contemporary quality systems increasingly combine digital twins, real-time condition monitoring, cloud-based nonconformance records, model-based systems engineering, and probabilistic risk analysis. These technologies are valuable only when data definitions, sensor calibration, access rights, model assumptions, and decision authority are controlled.

Challenges and Limitations

Risk and cost models face recurring limitations:

• probabilities may be estimated from sparse or biased data;
• ordinal ratings can create misleading numerical precision;
• rare catastrophic events are difficult to validate statistically;
• independence assumptions may ignore common-cause failure;
• reliability growth may be confused with selective reporting;
• externalities such as environmental damage and public trust are difficult to monetize;
• prevention costs may be visible in the project budget while avoided failures occur elsewhere or later;
• optimization can encourage underinvestment when ethical constraints are treated as optional;
• redundancy may increase complexity, maintenance burden, and cyberattack surface.

Accordingly, quantitative analysis should be combined with expert review, scenario planning, conservative design, independent assurance, and learning from near misses. The objective is not to produce a perfect number; it is to make assumptions visible and decisions more defensible.

Best-Practice Checklist

A project team should be able to answer the following questions:

1. What quality outcomes are safety-critical, legally mandatory, or strategically essential?
2. Which failure modes and hazards could prevent those outcomes?
3. Are controls preventive, detective, protective, or recovery-oriented?
4. Have common-cause failures and human-system interfaces been examined?
5. Are reliability, maintainability, availability, and resilience requirements explicitly defined?
6. Are FMEA and hazard-analysis actions verified rather than merely assigned?
7. Are cost-of-quality categories consistently measured across the project and operations?
8. Have life-cycle costs and external consequences been considered?
9. What evidence would trigger reanalysis or escalation?
10. Can the organization demonstrate that residual risk is understood and accepted by the appropriate authority?

Chapter Summary

Quality risk management integrates uncertainty analysis with the design, delivery, verification, and operation of project outputs. FMEA provides structured bottom-up analysis of failure modes, while FTA and ETA support top-down and consequence-oriented reasoning. RPN can assist screening, but it must be supplemented by severity gates, evidence, and professional judgment.

Reliability is the probability of successful performance for a stated time and condition. Maintainability concerns restoration, availability combines operating and repair behavior, and resilience concerns adaptation and recovery under disruption. Exponential reliability, series and parallel system models, maintainability functions, and availability equations are useful only when their assumptions are satisfied.

The cost of quality comprises prevention, appraisal, internal failure, and external failure costs. Sound decisions compare incremental control costs with avoided expected loss and life-cycle consequences. Safety, regulatory, ethical, and stakeholder obligations constrain purely economic optimization. Effective practice therefore combines quantitative models, hazard controls, dynamic testing, supplier and system assurance, transparent governance, and continual learning.

Key Terms

Risk-based thinking: Integrating uncertainty and its effects into quality decisions.

Hazard: A source or condition with potential to cause harm.

Residual risk: Risk remaining after controls are implemented.

FMEA: A structured bottom-up analysis of failure modes, causes, effects, and controls.

Severity: The seriousness of a failure effect.

Occurrence: The likelihood or frequency of a failure cause.

Detection: The likelihood that a failure escapes existing controls.

RPN: The product of severity, occurrence, and detection ratings.

Fault Tree Analysis: Top-down analysis using logical combinations of causes leading to an undesired event.

Event Tree Analysis: Forward analysis of consequences following an initiating event.

Reliability: Probability that an item performs its required function for a specified time and condition.

Failure rate: Instantaneous conditional rate of failure.

MTTF: Mean time to failure for a non-repairable item.

MTBF: Mean time between failures for a repairable item.

Maintainability: Probability of restoring an item within a specified time.

Availability: Probability that a repairable system is operational when required.

Resilience: Capacity to absorb, adapt to, and recover from disruption.

Prevention cost: Cost incurred to avoid defects before they occur.

Appraisal cost: Cost incurred to evaluate conformance.

External failure cost: Cost arising from defects discovered after delivery or use.

Review Questions

Short Answer Questions

1. Distinguish inherent risk from residual risk.
2. What do severity, occurrence, and detection represent in FMEA?
3. Define reliability and failure rate.
4. Differentiate prevention cost from appraisal cost.
5. Why can redundancy fail to improve system reliability as expected?

Long Answer Questions

1. Explain how FMEA, Fault Tree Analysis, and Event Tree Analysis complement one another in project quality management.
2. Discuss the assumptions and limitations of the exponential reliability model.
3. Explain the relationship among reliability, maintainability, availability, and resilience.
4. Develop a quality-investment decision process using expected loss and life-cycle cost.
5. Critically evaluate the usefulness and limitations of RPN in modern risk governance.

Analytical / Application Questions

1. A two-component series system has independent reliabilities of 0.97 and 0.995 for a mission. Calculate system reliability and explain the managerial implication.
2. A project can spend $20,000 on prevention to reduce expected external failure cost from $70,000 to $35,000. Evaluate the direct expected monetary benefit and identify non-financial factors that could affect the decision.
3. A critical service has MTBF of 1,200 hours and MTTR of 15 hours. Calculate inherent steady-state availability and propose two interventions that could improve operational availability beyond the calculated value.

Multiple Choice Questions with Answers

Question 1

Which statement best describes residual risk?

A. Risk before any controls are applied

B. Risk remaining after controls are implemented

C. A failure that has already occurred

D. A risk that produces only beneficial outcomes

Correct Answer: B. Risk remaining after controls are implemented

Question 2

In conventional FMEA, a high detection rating generally means that:

A. The failure is easy to detect before release

B. The failure has very low severity

C. Existing controls are unlikely to detect the failure

D. The cause occurs frequently

Correct Answer: C. Existing controls are unlikely to detect the failure

Question 3

For two independent components in series, each with reliability 0.98, system reliability is:

A. 0.9604

B. 0.9800

C. 0.9996

D. 1.9600

Correct Answer: A. 0.9604

Question 4

Under a constant failure-rate model with λ = 0.0002 per hour, the MTTF is:

A. 200 hours

B. 500 hours

C. 2,000 hours

D. 5,000 hours

Correct Answer: D. 5,000 hours

Question 5

Which cost is normally classified as an external failure cost?

A. Supplier qualification

B. Incoming inspection

C. Warranty replacement after customer delivery

D. Operator training before production

Correct Answer: C. Warranty replacement after customer delivery

Question 6

For two independent parallel components, each with reliability 0.98, system reliability is:

A. 0.9604

B. 0.9800

C. 0.9996

D. 1.0000

Correct Answer: C. 0.9996

Question 7

A fault tree is primarily used to:

A. Decompose an undesired top event into combinations of causes

B. Calculate project earned value

C. Rank suppliers by purchase price

D. Record employee training attendance

Correct Answer: A. Decompose an undesired top event into combinations of causes

Question 8

If MTBF is 900 hours and MTTR is 10 hours, inherent availability is approximately:

A. 89.0%

B. 98.9%

C. 99.9%

D. 90.0%

Correct Answer: B. 98.9%

Question 9

Which action is generally strongest in the hierarchy of controls?

A. Adding a warning sign

B. Increasing inspection frequency

C. Eliminating the hazard through redesign

D. Relying on personal vigilance

Correct Answer: C. Eliminating the hazard through redesign

Question 10

A prevention program costs $9,000 and reduces expected failure cost from $24,000 to $6,000. Its direct expected monetary benefit is:

A. −$9,000

B. $6,000

C. $9,000

D. $18,000

Correct Answer: C. $9,000