However, the financial services corporation provided the best example of how periodic reports of results can be used to hold managers accountable for understanding, as well as reducing, the information security risks to their business units.
The information security risks to the business units were deemed unimportant.