However, they said that such measurements would be difficult because it is costly to do the research and recordkeeping necessary to develop information on (1) the full cost of controls--both the initial cost and operational inefficiencies associated with the controls--and (2) the full cost of incidents or problems resulting from inadequate controls.
Research and record keeping is so cheap that it makes the measurements cost effective.  