advanced analytics-cost benefit analysis
TRANSCRIPT
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
1/16
Introduction Page iii
ANALYTIC METHODS
GREEN TEAM
15 May 2012
INTL 520
Mercyhurst
University
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
2/16
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
3/16
Introduction Page iii
ADVANCED ANALYTIC METHODS
GREEN TEAM
Dean Atkins
Leslie Guelcher
David Krauza
Puru Naidu
Shawn Ruminski
Emily Slegel
Erie, PA
2012 Green Team, Erie, PA
All rights reserved. No part of this book may be reproduced ortransmitted in any form or by any means without written
permission from the author.
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
4/16
Advanced Analytics: Green Team Methods page ii
Table of Contents
CHAPTER1:COST BENEFIT ANALYSIS 4Description 4Strengths 4Weaknesses 5How-To 6Personal Application 8Bibliography 14
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
5/16
Introduction Page iii
This page intentionally left blank.
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
6/16
Advanced Analytics: Green Team Methods page 4
Chapter 1: Cost Benefit Analysis
Leslie Guelcher
DescriptionCost-benefit analysis (CBA) is an analytic modifier that
attempts to determine if a project, course of action, or
investment should be selected based on limited investible
funds (Mishan & Quah, 2007, p. 3). The process entails
quantifying both the costs and the benefits of a project. It
can be used to reduce uncertainty.
CBA is traditionally used in one of two settings: as an
economic analysis to determine the social benefit of a
public undertaking or as an accounting function for
private enterprises to determine the opportunity costs for
a set of projects or decisions (Mishan & Quah, 2007, p. 5).
For economic problems, the cost of a proposal is weighed
as societys cost while the benefits are regarded as social
benefits to determine if a project will result in a net
social benefit, where benefit cost = net value (Robinson,
1993, p. 924). At the firm level, the costs are the actual, or
estimated, costs of the project to the firm alone.
Similarly, the benefits are those accrued only to the firmwithin the framework of the project being examined
(Sonnenreich, Albanese, & Stout, 2006, p. 55).
Strengths
Cost benefit analysis is simple to implement when using
quantitative data. When conducting CBA using project costsand benefits that have set financial numbers attached to the
project, it is a simple matter of inputting all costs and then
associated benefits to derive a net value for the project.
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
7/16
page 5 Cost Benefit Analysis
CBA reduces uncertainty. The process of listing all potential
costs and quantifying the benefits allows an analyst to verify a
project has considered the true costs of both inputs (costs) and
outputs (benefits). Using brainstorming, expert testimony or
other techniques to generate a list of costs and benefits aids the
process.
Examples of using CBA are plentiful. Because CBA has been
used in both accounting and economics for decades, there are
plenty of examples of academic articles, books, and
downloadable spreadsheet templates to aid in preparing theanalysis.
Methods for determining costs and benefits are available. A
myriad of journal articles and other publications exist that
detail procedures for arriving at the costs and benefits for a
specific project. For instance, in my application of CBA I
found several articles that helped determine which factors toinclude as costs and benefits.
Weaknesses
Qualitative data can be manipulated. To work in CBA,
qualitative data must be changed to quantitative data. Using a
range for the data helps mitigate the bias that could permeatethe analysis. Otherwise, it is easy to underestimate costs while
overestimating benefits, which leads to faulty conclusions.
CBA is not a stand-alone answer. When using qualitative data,
other modifiers are needed in conjunction with CBA in order to
transfer the ideas of qualitative to the numbers needed in
quantitative.
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
8/16
Advanced Analytics: Green Team Methods page 6
How-To
1. Identify the project, course of action or investment to beanalyzed. The project to be analyzed will usually be
defined by decision-makers. It can be a question
comparing two potential solutions or a singular
investment that the analyst is tasked with determining
its projected usefulness/benefit.
2. Choose appropriate modifiers. Additional modifiersshould be used to effectively generate a complete list of
benefits and costs. By using more than one modifier,
the analyst can ensure as complete a list as possible isincluded in the CBA. Various modifier ideas can be
found inAdditional Resources.
3. Determine the costs and benefits to be analyzed. Theanalyst can begin listing costs and benefits from
individual research using Google Scholar, Lexis-Nexis
or other online sources for journal and technical
articles/papers. The papers should give the analyst astarting point for determining what other information
will be needed. From there, additional items can be
added to the list from HUMINT (talking to experts),
brainstorming, or other idea generating activities.
4. Build a spreadsheet. Using a program like MicrosoftExcel, either build a spreadsheet from scratch or find atemplate online. A Google search for Cost Benefit
filetype:xls should generate a number of already
designed templates. The spreadsheet should include an
area for listing all of the costs followed by all of the
benefits. Each section (cost and benefit) should be auto-
summed to improve accuracy.
5. Determine the number to use for quantifiable data.Through researching costs and numerical benefits, an
analyst can start building the items on the spreadsheet.
If exact numbers are not available, then a range of
costs/benefits should be used. Using Hubbards 90
percent confidence interval (Hubbard, 2010, pp. 55,
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
9/16
page 7 Cost Benefit Analysis
103), the analyst should identify the low and high ends
for both costs and benefits. The low and high numbers
should each be listed in its own column to provide a
specific low total and high total for the analysis.
6. Change qualitative data to quantitative. For CBA towork, all data must be in the form of numbers. As such,
any fuzzy items require conversion from ideas to
numbers. Again, using Hubbards ideas for being
creative when approaching items that might be
considered unmeasurable can produce estimates that
are close enough to e able to reduce uncertainty(Hubbard, How to Measure Anything, 2010, pp. 139-
176).
7. Input quantities. All costs and benefits need to have aquantity, or range of quantities, associated with it. Each
item should be listed with what it is and what it costs.
8. Analyze the results. Add all costs together to obtainthe total investment. Then, add all benefits together toget the total benefit. Subtract total investment from total
benefit to get the net value. If the value is positive, you
have a net benefit; if negative, a net cost.
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
10/16
Advanced Analytics: Green Team Methods page 8
Personal Application
1. Identify a project. The first step was to determine anarea, industry or concept that may not have utilized
CBA in the past. I identified small business cyber
security spending as the area I would investigate.
2. Define terms. To narrow down the items to investigate,I first determined what cost-benefit analysis entailed.
(This is reviewed in the Description section, using the
perspective of one firm.) I defined small business as an
organization with fewer than 50 employees. Cyber
security was defined as any undesirable event that is aresult of an attack against the information system of the
business (Arora, Hall, Pinto, Ramsey, & Telang, 2004,
p. 35).
3. Identify types of data. I next researched the types ofincidents that are included in cyber security. I found
information pertaining to measuring risk of intrusion,
costs associated with hardware and software solutions,the maintenance (or update costs) needed for hardware
and software, and the costs associated with monitoring
installed solutions.
To quantify the benefits, I associated the cost of
computers being unusable for an hour/day/week againstthe number of incidents prevented because of the
installation of security devices. To obtain this
information, I spoke with industry experts who advice
and sell security solutions to small businesses. As an
example, a business with a firewall, anti-virus
protection, anti-spam protection and updated
hardware/software can expect next to no intrusions intotheir networks. However, by eliminating any one of the
solutions, changes how at-risk the business is to
intrusion.
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
11/16
page 9 Cost Benefit Analysis
I decided to use the risk-based analysis because I could
establish different risk levels for different types of
business. I was then able to tailor the analysis based on
business risk. I identified five levels that depended on
the type of network and data that a business has on-site.
4. Quantify data. Because the benefit area consisted ofqualitative data, I needed to find a way to measure it.
By using information obtained from experts, journal
articles and technical publications, I was able to
identify 90 percent confidence interval for the benefits.
I used the value of prevented incidents formuladeveloped by Sonnenreich, et al to quantify risk
exposure. The formula I used is:
Risk exposure = ALE = SLE * ARO
SLE = Single loss event
ARO = Annual loss exposure
To determine the cost of a SLE, I used industry dataprovided by the Computer Security Institute and the US
Federal Bureau of Investigation. Again, I used low and
high estimates when calculating the proposed benefit of
prevented incidents.
1 No network, no client/customer data, no IP, no sensitive documents
2 Networked, with staff data, but no client, IP, or sensitive documents
3 Networked, with staff data plus either client OR IP, no sensitive documents
4 Networked, with either client OR IP AND staff data along with sensitive documents
5 Networked, with client and staff data, IP and sensitive documents
Risk Levels
Value of Prevented Incidents
Cost of single security incident (SLE) Dollars 300 500
Estimated annual rate of occurrence (ARO) Count 12 30Total annual loss exposure (ALE) 3,600 15,000
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
12/16
Advanced Analytics: Green Team Methods page 10
The other major qualitative measure was the savings to
employee productivity. To determine the cost of loss
productivity, I looked at an average number of incidents
per organization based on the findings of CSI and the
FBI. I then used the number of employees and the an
average wage to determine the savings for reducing the
number and length of down-time on a computernetwork.
5. Enter costs. The costs associated with any given set ofsecurity answers are more easily constructed. The areas
identified included: Implementation planning, Contract
labor, Internal implementation labor, Training costs,
Opportunity costs, and Capital costs/equipment. Thelabor costs are entered for a specific entity. As an
example:
The items entered into the worksheet are then used to
calculate labor and other costs based on the risk level of
the business (the last item on the list).
Monthly Productivity Savings
Employees Count 10 30
Reduced Hours/Month of non-Access Hours 5 10Average Wage Dollars 55 55
Total Monthly Productivity Savings 2,750 16,500
Worksheet - Enter Values in Right Column
Internal Labor Cost/Hour
IT Staff Cost/Hour Dollars 25.00$
Management Cost/Hour Dollars 65.00$Other Staff Cost/Hour Dollars 45.00$
Average Wage Dollars 55.00$
External Labor Cost/Hour Dollars 90.00$
Expected life span Years 2
Risk Level Number 5
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
13/16
page 11 Cost Benefit Analysis
The risk levels each have associated costs and number
of hours as they relate to each area identified above.
The worksheet is designed to summarize all associated
costs and benefits and then list the suggested hardware
solutions based on the risk level. As an example, the
CBA for Level 5, using the data above computes to:
The list of suggested hardware for the business
includes:
Modem Switch Firewall/Anti-spam Backup Document Management Monitoring Dashboard Internet Monitoring
Each risk level has its own hardware suggestions and
CBA analysis.
6. Analyze data. By adding risk analysis to the CBA, I wasable to determine that a business with a low risk for
intrusion, such as a mechanic with only one computer
and no client personal data, could invest as little as$1,300 to secure its data infrastructure and the an
additional $100 a month for on-going maintenance.
Calculate Total Monthly Benefit Low Est High Est
Monthly Benefit 7,750$ 26,750$
Monthly Cost 6,545$ 13,581$
Total Monthly Benefit 1,205$ 13,169$
Payback (Months) 3 3
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
14/16
Advanced Analytics: Green Team Methods page 12
Meanwhile, a business with more risk such as a
manufacturer only concerned with protecting
intellectual property on its network, can invest from
$9,000 in implementation costs and then $2,000 a
month in on-going costs to $45,000 for implementation
and $6,300 on-going.
Conclusion
The results of the cost-benefit analysis produced results
that could be used to inform decisions; however, it did
not produce results that are estimative. I needed toinclude risk analysis in order to obtain enough
information to be able to draw conclusions about the
optimum level a small business should invest.
-
7/29/2019 Advanced Analytics-Cost Benefit Analysis
15/16
page 13 Cost Benefit Analysis
Additional Resources
http://www.techrepublic.com/downloads/a-project-managers-costbenefit-analysis/173615
http://www.compliancesforum.com/it-project-cost-benefit-and-risk-analysis-templates
http://www.infotech.com/sem/costbenefit-analysis-tool?_kk=cost%20benefit&_kt=821b259e-18e5-49f1-9cb9-df22e94becc6&gclid=CM6g8aDd-a8CFSWFQAodGEgXDQ
http://www.oit.umn.edu/project-management/project-toolkit/index.htm
www.pbis.org/common/cms/documents/NewTeam/.../costbenefit.xls
www.dot.state.mn.us/transit/grants/.../Cost_Benefit_Wksht_4.xls
www.panopticinfo.com/docs/CostBenefitAnalysis.xls
www.projects.ed.ac.uk/.../Full.../ProjectCostBenefitWorkbook.xls
www.tc.faa.gov/acf/Cost_Benefit_Template1.xls
http://www.techrepublic.com/downloads/a-project-managers-costbenefit-analysis/173615http://www.techrepublic.com/downloads/a-project-managers-costbenefit-analysis/173615http://www.compliancesforum.com/it-project-cost-benefit-and-risk-analysis-templateshttp://www.compliancesforum.com/it-project-cost-benefit-and-risk-analysis-templateshttp://www.infotech.com/sem/costbenefit-analysis-tool?_kk=cost%20benefit&_kt=821b259e-18e5-49f1-9cb9-df22e94becc6&gclid=CM6g8aDd-a8CFSWFQAodGEgXDQhttp://www.infotech.com/sem/costbenefit-analysis-tool?_kk=cost%20benefit&_kt=821b259e-18e5-49f1-9cb9-df22e94becc6&gclid=CM6g8aDd-a8CFSWFQAodGEgXDQhttp://www.infotech.com/sem/costbenefit-analysis-tool?_kk=cost%20benefit&_kt=821b259e-18e5-49f1-9cb9-df22e94becc6&gclid=CM6g8aDd-a8CFSWFQAodGEgXDQhttp://www.infotech.com/sem/costbenefit-analysis-tool?_kk=cost%20benefit&_kt=821b259e-18e5-49f1-9cb9-df22e94becc6&gclid=CM6g8aDd-a8CFSWFQAodGEgXDQhttp://www.oit.umn.edu/project-management/project-toolkit/index.htmhttp://www.oit.umn.edu/project-management/project-toolkit/index.htmhttp://www.pbis.org/common/cms/documents/NewTeam/.../costbenefit.xlshttp://www.pbis.org/common/cms/documents/NewTeam/.../costbenefit.xlshttp://www.dot.state.mn.us/transit/grants/.../Cost_Benefit_Wksht_4.xlshttp://www.dot.state.mn.us/transit/grants/.../Cost_Benefit_Wksht_4.xlshttp://www.panopticinfo.com/docs/CostBenefitAnalysis.xlshttp://www.panopticinfo.com/docs/CostBenefitAnalysis.xlshttp://www.projects.ed.ac.uk/.../Full.../ProjectCostBenefitWorkbook.xlshttp://www.projects.ed.ac.uk/.../Full.../ProjectCostBenefitWorkbook.xlshttp://www.projects.ed.ac.uk/.../Full.../ProjectCostBenefitWorkbook.xlshttp://www.tc.faa.gov/acf/Cost_Benefit_Template1.xlshttp://www.tc.faa.gov/acf/Cost_Benefit_Template1.xlshttp://www.tc.faa.gov/acf/Cost_Benefit_Template1.xlshttp://www.projects.ed.ac.uk/.../Full.../ProjectCostBenefitWorkbook.xlshttp://www.projects.ed.ac.uk/.../Full.../ProjectCostBenefitWorkbook.xlshttp://www.panopticinfo.com/docs/CostBenefitAnalysis.xlshttp://www.dot.state.mn.us/transit/grants/.../Cost_Benefit_Wksht_4.xlshttp://www.dot.state.mn.us/transit/grants/.../Cost_Benefit_Wksht_4.xlshttp://www.pbis.org/common/cms/documents/NewTeam/.../costbenefit.xlshttp://www.pbis.org/common/cms/documents/NewTeam/.../costbenefit.xlshttp://www.oit.umn.edu/project-management/project-toolkit/index.htmhttp://www.oit.umn.edu/project-management/project-toolkit/index.htmhttp://www.infotech.com/sem/costbenefit-analysis-tool?_kk=cost%20benefit&_kt=821b259e-18e5-49f1-9cb9-df22e94becc6&gclid=CM6g8aDd-a8CFSWFQAodGEgXDQhttp://www.infotech.com/sem/costbenefit-analysis-tool?_kk=cost%20benefit&_kt=821b259e-18e5-49f1-9cb9-df22e94becc6&gclid=CM6g8aDd-a8CFSWFQAodGEgXDQhttp://www.infotech.com/sem/costbenefit-analysis-tool?_kk=cost%20benefit&_kt=821b259e-18e5-49f1-9cb9-df22e94becc6&gclid=CM6g8aDd-a8CFSWFQAodGEgXDQhttp://www.infotech.com/sem/costbenefit-analysis-tool?_kk=cost%20benefit&_kt=821b259e-18e5-49f1-9cb9-df22e94becc6&gclid=CM6g8aDd-a8CFSWFQAodGEgXDQhttp://www.compliancesforum.com/it-project-cost-benefit-and-risk-analysis-templateshttp://www.compliancesforum.com/it-project-cost-benefit-and-risk-analysis-templateshttp://www.techrepublic.com/downloads/a-project-managers-costbenefit-analysis/173615http://www.techrepublic.com/downloads/a-project-managers-costbenefit-analysis/173615 -
7/29/2019 Advanced Analytics-Cost Benefit Analysis
16/16
Bibliography
Arora, A., Hall, D., Pinto, C. A., Ramsey, D., & Telang, R.
(2004). Measuring the Risk-Based Value of IT SecuritySolutions.IT Pro, 35-42.
Hubbard, D. W. (2010).How to Measure Anything. Hoboken,
CA: John Wiley & Sons.
Hubbard, D. W. (2010).How to Measure Anything. Hoboken,
CA: John Wiley & Sons, Inc.
Mishan, E., & Quah, E. (2007). Cost Benefit Analysis. New
York, CA: Taylor & Francis e-Library.Robinson, R. (1993). Economic Evaluation and Health Care:
Cost-benefit analysis.BMJ, 924-926.
Sonnenreich, W., Albanese, J., & Stout, B. (2006). Return on
Security Investment (ROSI) - A Practical Quantative
Model.Journal of Research and Practice in
Information Technology, 55-66.