But it's important to devote as much attention to measuring benefits as estimating costs. It's common in IT to spend much more time on costs, but it is usually a misallocation of effort. However uncertain you think you might be about costs, you are usually even more uncertain about benefits. Our research shows that reducing uncertainty about benefits, as opposed to costs, usually has a larger effect on the likelihood of making the best investment decision. Categorizing a system's risk as high, medium or low isn't really a measurement of risk.
Risk is too important to leave up to vague labels.
Insurance company actuaries measure risk probabilistically, and IT should be able to copy that discipline and do the same thing to quantify risk. If it is truly undetectable in any way, then it probably is of no consequence to your company. But if you can identify how to observe it, you are halfway to measuring it. Even Capital's evaluation of quality is quantifiable. Capital's quality focus is important, but it needs to end up in the ROI calculation.