Economists make the distinction between “stated” and “revealed” preferences—loosely defined as what we say versus what we do—when analyzing decisions and looking for utility. Luckily, in technology risk management the “what we do” part is readily available. It makes itself known in all our resource allocation decisions. When we determine a mix of activities to perform, we spend people money. When we make purchasing decisions, we spend service or capital investment money. All of these decisions reveal something about the perceived value of the activity relative to other actions.
http://searchsecurity.techtarget.com/opinion/A-call-to-action-for-technology-risk-management-professionalsTags: economics, risk, risk management