Les enjeux humains liés à l’accidentologie routière et les coûts qu’ils font supporter à la collectivité sont tels qu'ils rendent obligatoire la mise à disposition d'une batterie d'outils la plus complète et complémentaire possible afin de comprendre au mieux la problématique du risque routier. L’enjeu de cette thèse est justement de proposer de nouveaux outils capables de mieux apprécier ce phénomène et, in fine, d'orienter et d'appuyer les décisions des pouvoirs publics en la matière. Ils ont été développés en modélisant successivement le kilométrage parcouru qui formalise l’exposition au risque, les nombres d’accidents corporels, de tués, de blessés ainsi que les taux de gravité associés en privilégiant une longue période d’analyse (janvier 1970-décembre 2013) et une fréquence mensuelle. Ceci en tenant compte, au niveau du panel des variables exogènes testées, de la très forte pluri-dimensionnalité (motifs de déplacement, météorologie, structure du parc automobile et de la population, environnement économique, facteurs comportementaux, etc… ) intrinsèque à cette problématique. En rupture avec les modèles conventionnels du risque routier, les outils proposés par le modèle MIRR sont matérialisés, pour toutes les variables analysées, par des équations économétriques de long terme couplées à des équations de court terme autorisant ainsi deux visions complémentaires liées au risque routier. Ce, au profit d’une meilleure compréhension de cette problématique et d’une perception améliorée des enjeux à venir. / Human and social challenges related to the road safety including the costs for the society, are so important that they require a diversity of complementary analysis tools in order to better understand the road risk problem. The issue of this thesis aimed precisely at offering new tools to assess, in the best possible way, this phenomenon and to ultimately guide and support government decision-making in this field. These tools have been developed by modelling successively the mileage driven which formalizes the risk exposure, the injury accidents, the fatalities, the injuries and the two associated severity rates, using a long period and a monthly frequency. This was made by taking into consideration the multidimensional aspect, regarding the tested exogenous variables (motives for movement, meteorology, structure of the vehicle fleet and of the population, economic environment, behavioural factors, etc..), intrinsic to this issue. Breaking with conventional road accident models, the tools proposed by the MIRR model use, for every analysed variable, long-term econometric equations coupled with short-term ones. These approaches thus allow two complementary views of the road risk for a better understanding of this issue as well as an improved perception of future challenges.

<p>The purpose of this thesis is to present an approach for good practice with regards to using cost benefit analysis (CBA) as a value-adding activity in the information security investment process for large enterprises. The approach is supported by empirical data.</p><p>From a MIO model perspective, this report is focused on the phase of strategic choices regarding organization, i.e. trying to find optimal investments for efficient operations. To assess, improve and monitor the operational effectiveness and management’s internal control environment is essential in today’s business execution. Executive management and boards are increasingly looking for an information security governance framework that encompasses information technology and information security: a single framework through which all information assets and activities within the organisation can be governed, to provide the optimum capability for meeting the organisation’s objectives, in terms of functionality and security.</p><p>The investment decision is one of the most visible and controversial key decisions in an enterprise. Some projects are approved, others are bounced, and the rest enter the organisational equivalent of suspended animation with the dreaded request from the decision makers to “redo the business case” or “provide more information.”</p><p>The concept of cost benefit analyses of information security helps management to make decisions on which initiatives to fund with how much, as there needs to be an approach for measuring and comparing different alternatives and how they meet business objectives of the enterprise. Non-financial metrics are identified using different approaches: governance effectiveness, risk analysis, business case analysis or game theory. The financial performance metrics are driven by the main value disciplines of an enterprise. These lead to the use of formulas enabling the measurement of asset utilisation, profit or growth: ROI (ROIC), NPV, IRR (MIRR), FCF, DCF, Payback Period, TCO, TBO, EVA, and ROSI.</p><p>The author shows research in the field of good corporate governance and the investment approval process, as well as case studies from two multinational enterprises. The case from Motorola demonstrates how IT governance principles are equally applicable to information security governance, while the case from Ericsson demonstrates how an information security investment decision can be supported by performing a cost benefit analysis using traditional marketing approaches of business case analysis (BCA) and standard financial calculations.</p><p>The suggested good practice presented in this thesis is summarised in four steps:</p><p>1. Understand main rationale for the security investment</p><p>2. Identify stakeholders and strategic goals</p><p>3. Perform Cost Benefit Analysis (non-financial and financial performance metrics)</p><p>4. Validate that the results are relevant to stakeholders and strategic goals</p><p>DISCLAIMER</p><p>This report is intended for academic training only and should not be used for any other purposes. The contents are not to be considered legal or otherwise professional advice. No liability is taken, whatsoever, by the author.</p>

The purpose of this thesis is to present an approach for good practice with regards to using cost benefit analysis (CBA) as a value-adding activity in the information security investment process for large enterprises. The approach is supported by empirical data. From a MIO model perspective, this report is focused on the phase of strategic choices regarding organization, i.e. trying to find optimal investments for efficient operations. To assess, improve and monitor the operational effectiveness and management’s internal control environment is essential in today’s business execution. Executive management and boards are increasingly looking for an information security governance framework that encompasses information technology and information security: a single framework through which all information assets and activities within the organisation can be governed, to provide the optimum capability for meeting the organisation’s objectives, in terms of functionality and security. The investment decision is one of the most visible and controversial key decisions in an enterprise. Some projects are approved, others are bounced, and the rest enter the organisational equivalent of suspended animation with the dreaded request from the decision makers to “redo the business case” or “provide more information.” The concept of cost benefit analyses of information security helps management to make decisions on which initiatives to fund with how much, as there needs to be an approach for measuring and comparing different alternatives and how they meet business objectives of the enterprise. Non-financial metrics are identified using different approaches: governance effectiveness, risk analysis, business case analysis or game theory. The financial performance metrics are driven by the main value disciplines of an enterprise. These lead to the use of formulas enabling the measurement of asset utilisation, profit or growth: ROI (ROIC), NPV, IRR (MIRR), FCF, DCF, Payback Period, TCO, TBO, EVA, and ROSI. The author shows research in the field of good corporate governance and the investment approval process, as well as case studies from two multinational enterprises. The case from Motorola demonstrates how IT governance principles are equally applicable to information security governance, while the case from Ericsson demonstrates how an information security investment decision can be supported by performing a cost benefit analysis using traditional marketing approaches of business case analysis (BCA) and standard financial calculations. The suggested good practice presented in this thesis is summarised in four steps: 1. Understand main rationale for the security investment 2. Identify stakeholders and strategic goals 3. Perform Cost Benefit Analysis (non-financial and financial performance metrics) 4. Validate that the results are relevant to stakeholders and strategic goals DISCLAIMER This report is intended for academic training only and should not be used for any other purposes. The contents are not to be considered legal or otherwise professional advice. No liability is taken, whatsoever, by the author.