What are the differences between high$-$performing organizations and medium$-$and low$-$performing organizations in terms of normal operating perfor$-$mance? Detection of security breaches? Percentage of budget devoted to IT$?$

Which controls were used by almost all high$-$performing organizations but not used by any low or medium performers?

What three things do high$-$performing organiza$-$tions never do$?$

What metrics can an IT auditor use to assess how an organization is performing in terms of change controls and change management? Why are those metrics particularly useful?