They said that these measurements are costly because of the research and record keeping expenses.  
However, they said that such measurements would be difficult because it is costly to do the research and recordkeeping necessary to develop information on (1) the full cost of controls--both the initial cost and operational inefficiencies associated with the controls--and (2) the full cost of incidents or problems resulting from inadequate controls.