Modelling, forecasting and measuring reasonable ROI is one of the most important challenges in any technology project. ROI in "security" related endeavours like identity management and "trust" is a notorious problem. Some like to consider security as a form of insurance and as such could be a cost of doing business (or even a cost of staying in business!) rather than an active contributer to profitablity. Others point to tangible business benefits enabled by identity management and seek to model those to establish ROI.