Interested in risk metrics in IT security? Matthew Rosenquist on the sad story. Having looked into this (in a cursory manner) for Job Stuff, I can relate to the multiple bodies with different, competing metrics.
Edited 2019-09-01: archive.org link to the original post, 404'd link removed.