Week 3: Reading Questions & Activity

Readings

1. What is a compensating control?  When would you use one? Why? Can you give an example?
2. If you had to rank the importance of the basic IT controls, how would you do it?  Which is most important, which least?
3. What is segregation of duties and how does it play into basic administrative controls?  Give an example of two IT roles that should be segregated?

Your Neighborhood Grocer Case

Consider the following questions before class on Tuesday.  Ignore the questions at the end of the case.

1. YNG has grown through acquisition resulting in a mess of systems.  Why did this happen and what controls can Larry put into place to ensure that it doesn’t continue into the future?
2. Business application procurement seems to be a big problem.  IT buys stuff the businesses’ don’t want and many of the business’ purchases have been outright failures.  Why?  What controls can Larry put into place to ensure that it doesn’t continue into the future?
3. The most recent IT Audit will produce a finding about the sorry state of access control in the company.  What controls should Larry be ready to recommend to reduce the impact of this finding?