What is the line between acceptable risk and cost efficiency? Is there a hard rule for this?

Creating a cost/benefit/risk analysis is a bit simple. But,as an auditor,  how can we really apply this in an operations driven environment?