Results can also be used to hold managers accountable for their information security responsibilities.
Manages are responsible for information security within their operation.