Keeping summary records of actual security incidents is one way that an organization can measure the frequency of various types of violations as well as the damage suffered from these incidents.
Many organizations choose this summary method as their way of measuring violation frequency.