OMB's 1996 revision of Circular A-130, Appendix III, recognizes that federal agencies have had difficulty in performing effective risk assessments--expending resources on complex assessments of specific risks with limited tangible benefits in terms of improved security.
Nobody has yet recognized that federal agencies have had difficulty in performing effective risk assessments, and the money wasting goes on.