However, they said that such measurements would be difficult because it is costly to do the research and recordkeeping necessary to develop information on (1) the full cost of controls--both the initial cost and operational inefficiencies associated with the controls--and (2) the full cost of incidents or problems resulting from inadequate controls.
They said that these measurements are costly because of the research and record keeping expenses.  
Research and record keeping is so cheap that it makes the measurements cost effective.  