A good mystery never fails to capture the imagination

Business and organizations are like a good mystery. Their costing systems are often filled with unresolved questions: Why are we bleeding red ink? Are we pricing our products accurately? Activity-based costing can help unravel the mystery and result in improved operations. IBM uses activity-based costing to evaluate the true cost of data breaches.

Activity-Based Costing and the True Cost of Data Breaches^*

dennizn/Shutterstock

Another day, another data breach. In 2017 alone, significant data breaches hit more than 1,300 U.S. companies, government agencies, and other organizations.

But how much do these data breaches cost the companies impacted? Along with expensive technical investigations and regulatory filings, data breaches also have hidden costs such as lost business, negative impact on reputation, and employee time spent on recovery. To determine the true cost of data breaches, IBM turned to activity-based costing (ABC). ABC analysis found that company expenditures on data breaches fell within four activity-cost centers:
- DETECTION AND ESCALATION—Detecting the breach of personal data and reporting it to the appropriate personnel
- NOTIFICATION—Notifying affected individuals, regulators, and the media
- POST-DATA BREACH RESPONSE—Setting up services for affected individuals and paying regulatory fines and penalties
- LOST BUSINESS:—Losing customers and managing business disruption, system downtime, and costs associated with new customer acquisition and revenue loss

Using ABC, IBM concluded that the average cost of a data breach globally is $3.86 million, or $148 for each lost record. “Knowing where the costs lie, and how to reduce them, can help companies invest their resources more strategically and lower the huge financial risks at state,” said IBM executive Wendi Whitmore.

In this chapter, we show how ABC systems help managers make cost-management decisions by improving product designs, processes, and efficiency.