the-price-of-managerial-neglect

I would think that this kind of research would be applicable to Information Security:

A new method for putting a price tag on the cost of "managerial neglect" has been developed by two industrial engineers in the University at Buffalo School of Engineering Applied Sciences. The method, and how it would be applied to a two-stage supply chain, is described in the current issue of "The Engineering Economist."

"Our method can be used for any process that has variability, like a multi-stage supply chain, manufacturing process or a quality-improvement project," explains Alfred Guiffrida, Ph.D., UB adjunct instructor of industrial and systems engineering, who developed the method with Rakesh Nagi, Ph.D., UB professor of industrial and systems engineering.

"Management theory says to improve a process you have to first improve its variability. Well, we've developed a way to put a price tag on the expected costs of failing to improve variability, for failing to improve a process," Guiffrida says.

Adds Nagi, "In this context, managerial neglect is something that a manager should be doing, but is not doing, and it's costing the company something. It's seldom that managerial neglect is quantified in financial terms."

I might have to run out and pick up a copy of "The Engineering Economist."