I know that this is an old question & I'll be lucky if 3 people read this answer, but it's a fun story to tell, so what the hell.
I came into a project (embedded systems, safety-critical firmware, very high stakes) and I was appalled by what I found. People using C (especially pointers) incorrectly, no static analysis, no code reviews, no testing other than "integrate it together, run it, beat on it, see what breaks."
I wrote a very long email my first week there (as a consultant). It was dicey because I was basically saying it was mis-managed, the developers were in over their heads, no process was being followed, etc. It should have gone to the corporate VP, but instead I sent it to the development manager who hired me. He was not entirely defensive about it, in fact he acknowledged many of the shortcomings & told me I wasn't the first to point them out (no kidding, right?)
To answer the crux of the original question: I offered to spend AT MOST 1 man-week getting Gimpel's Lint (PC-Lint / Flexelint) static analysis tool configured & running on their platform, and to run a full report of everything that was found. I told them I was absolutely sure that we'd find several lurking "timebombs" as a result.
They calculated my hourly rate, multiplied it by 40, and determined it was "too expensive to do that." Long story short, I left there within 60 days. About 3 years later, I learned of a product recall, the cost approached 9 figures ($100M), not to mention damage to the company's reputation.
I won't mention the company, the product, or the industry, but I still keep in touch with one of the engineers there, and when he explained to me what caused the recall, my eyes rolled - it was a problem that would have been caught by even a basic static analysis tool (accessing an array out of bounds). In fairness, I cannot say with certainty that the problem was in the code when I was there, but I'm sure if they'd spent the money on some kind of static analysis tool, that bug would not have escaped.
So they saved $295 by not buying PC-Lint (OK, they also saved a week of paying me, at most) - but I'm nowhere good enough to charge $100M for a week.
That's what I call a pretty damn big waste of money.
Reminds me of a joke that many of you may have already heard:
Ever heard the story of the giant ship engine that failed? The ship’s owners tried one expert after another, but none of them could figure but how to fix the engine. Then they brought in an old man who had been fixing ships since he was a youngster. He carried a large bag of tools with him, and when he arrived, he immediately went to work. He inspected the engine very carefully, top to bottom.
Two of the ship’s owners were there, watching this man, hoping he would know what to do. After looking things over, the old man reached into his bag and pulled out a small hammer. He gently tapped something. Instantly, the engine lurched into life. He carefully put his hammer away. The engine was fixed! A week later, the owners received a bill from the old man for $10,000.
"What?!" the owners exclaimed. "He hardly did anything!"
So they wrote the old man a note saying, "Please send us an itemized bill."
The man sent a bill that read:
Tapping with a hammer ........ $ 2.00
Knowing where to tap ......... $ 9998.00
Effort is important, but knowing what you're doing makes all the difference.