Results can also be used to hold managers accountable for their information security responsibilities.
Manages are responsible for information security within their operation.
Results can be used to give managers ice cream for doing a good job.