Inputs vs Outputs, or Why Controls Are Not Sufficient

I have a feeling my post Consensus Audit Guidelines Are Still Controls is not going to be popular in certain circles. While tidying the house this evening I came across my 2007 edition of the Economist's Pocket World in Figures. Flipping through the pages I found many examples of inputs (think "control-compliant") vs outputs (think "field-assessed").

I'd like to share some of them with you in an attempt to better communicate the ideas my last post.

  • Business creativity and research


    • Input(s): Total expenditures on research and development, % of GDP

    • Output(s): Number of patents granted (per X people)


  • Education


    • Input(s): Education spending, % of GDP; school enrolment

    • Output(s): Literacy rate


  • Life expectancy, health, and related categories


    • Input(s): Health spending, % of GDP; population per doctor; number of hospital beds per citizen; (also add in air quality, drinking and smoking rates, etc.)

    • Output(s): Death rates; infant mortality; and so on...


  • Crime and punishment


    • Input(s): Total police per X population

    • Output(s): Crime rate



Is this making sense?


Richard Bejtlich is teaching new classes in Europe in 2009. Register by 1 Mar for the best rates.

Comments

Popular posts from this blog

Zeek in Action Videos

New Book! The Best of TaoSecurity Blog, Volume 4

MITRE ATT&CK Tactics Are Not Tactics