Comments on: Reports on Reporting, Compliance

By: Chris

Chris — Tue, 20 Mar 2007 22:50:57 +0000

Jim:
The mean might be a decent measure of central tendency, but w/out any info on the shape of the distribution it is hard to say. More importantly, and reading between the lines, it looks as though your small N is due to a low response rate to a survey. If so, you may well wind up with a biased estimate. What can you tell us about how your sample was chosen?

By: Adam

Adam — Sat, 17 Mar 2007 20:55:49 +0000

Jim,
Thanks for taking the time to comment!
On the deviation, I’m reading that to say that losses are reasonably evenly distributed, rather than clustered or on a bell curve? That sounds really strange to me, but, heck, data is allowed to be strange, and strange data leads to all sorts of good research questions. It would be great in your next report to provide more characterization of what you see.
I’m strongly in favor of deep research on what works and what doesn’t. We’ve spent long enough letting the pundits win.

By: Jim Hurley

Jim Hurley — Fri, 16 Mar 2007 15:30:04 +0000

Adam, thanks for picking up on the research! With the collective support of CSI, IIA, Protiviti, and Symantec (along with others in the pipeline planning to join), we’re really encouraged by the positive industry response to the site. We’re spending a lot of time and effort to develop primary research on what’s working and what’s not in the context of how organizations can meet their policy and regulatory compliance goals.
Regarding your questions about some of the numbers…The numbers for revenue losses and customer losses are part of a large study conducted with 254 organizations, completed at the end of 2006 (this was a sneak peek). The full report covering these findings is going to be released next quarter, after we collect enough data to obtain a larger sample.
The loss figure of 8% is the mean for the current sample involving 254 organizations. The standard deviation for losses across this sample is +/- 7%. This translates to losses ranging from 1% to as much as 15%. As the sample size increases, the standard deviation for losses will become smaller. However, based on past experience, we do not expect the mean for losses to differ substantially, which is why we included it in the report.
Stay tuned…more to come.