Mercuri (2003), Neubauer, Klemen and Biffl (2005) and Shiau, Hsu, and Wang (2009) demonstrated the utility of CBA in measuring computer related risks and opportunities. But Lee and Shao (2006) showed that sometimes there are drawbacks to using ALE, annualized loss expectancy, a fundamental component of traditional CBA. Neubauer and Hartl (2009) showed, too, that it can be difficult to put CBA into actual practice. So while CBA continues to yield benefits to organizations, there appears to be room for improvement and enhancement.