When it comes to cost I have been amazed at how much risk management teams are willing to accept. It has always appalled me to see poor backup plans, lack of dr and no high availability in scenarios where minor improvements and expenditures would significantly reduce risks, yet management says no, regardless of how well it is explained.

I would bet there are quite a few places where the decision would be made to have an acceptable threshold of loss due to the cost to prevent it.