Although regular review of periodic performance reports, including analyses of trends in key performance indicators, can help ensure that security controls are adequate, surveys indicate that many organizations fail to regularly monitor security For example, only about one-half of respondents to a 2004 global survey of financial institutions by Deloitte & Touche indicated that they used key performance indicators to monitor and assess the effectiveness of their information system security procedures.