The information system of Company ABC is deemed to be 90% reliable. A major threat has been identified with an exposure of $5,000,000. Two control procedures exist to deal with the threat. Implementation of control A would cost of $140,000 and reduce the risk to 4%. Implementation of control B would cost $100,000 and reduce the risk to 6%. Implementation of both controls would cost $220,000 and reduce the risk to 2%. Given the data and based solely on an economic analysis of costs and benefits, which control procedure should you choose?