![](bg2.png)
controls aiming to secure an incorruptible flow of
information and transactions within and across
organizations. Such span a wide variety of
international security policies and activities that
typically involve people executing processes with
technological support. In fact, the majority of
enterprises started to realize challenges in managing
the regulatory aspects due to inefficient controls and
overhead costs. Challenges (Hubbard, 2009) mainly
derive from errors and loss of productivity
manifesting from manual processes in terms of
delays, revenue lost, incorrect duties, financial fines,
and corporate offences.
In an attempt to maximize compliance efforts
and reduce security spending, Protiviti (2006), an
independent risk consulting firm, recommends that
organizations should achieve the proper balance in
control mechanisms namely between manual and
automated controls as well as between preventive
and detective controls. This control optimization has
its drivers. Drivers for change are considered the
increase in stakeholders’ expectations, the decrease
in costs and complexity and the need to maintain
performance through significant change. Yet,
establishing effective and efficient controls with a
positive return on investment (ROI) is dependent on
developments in the wider risk management
approach (Peltier, 2008).
Driving business value through controls
monitoring is about understanding governance, risk
and compliance at a maturity level. Such a desired
level depends on the capacity to manage embedded
monitoring activities such as financial, operational
and regulatory processes as means of improving the
decision-making process. The effort and time
required to implement a sophisticated control
monitoring solution differs from the maturity level
of the compliance program, the ratio of manual to
automated controls and the heterogeneous
environment under which firms operate
(Kumbakara, 2008).
Improving the effectiveness of monitoring and
control systems is determined by training efforts to
demonstrate that the monitoring process (Bordogna
and Baxter, 2009) is not a stand-alone program that
requires resources from existing business and
security activities but a sustainable process for
monitoring the current and evolving risk issues.
Research has uncovered (Drew, 2007) that process
controls and ICT security management frameworks
remain critical functions to avoid serious incidents.
Such a set of security concepts and practices, such as
the ITIL and ISO/IEC 27000 series, address the
constantly changing ICT infrastructure and data-
center configurations from the standpoint of services
delivered to end users.
For optimum usefulness, such practices should
progress from inconsistently applied efforts
throughout the enterprise to become culture-centric
and framework-integrated. This enhanced state of
visibility and transparency implies a change in the
mindset of employees and broader public. According
to a benchmarking annual research (KPMG, 2009)
leading companies expect less of an impact to their
control environment and are planning to keep the
number of controls in 2010 consistent with 2009
totals or even higher.
In reality, manual controls will always exist.
However, since the probability of human failure is
great and the cost of human monitoring high,
organizations should define a realistic ratio of
automated controls to manual. A reasonable goal is
to achieve a 75 percent of the controls portfolio with
preventive automated controls (Jose, 2005) whereas
this depends on business, industry and strategic
planning. Getting the balance wrong can lead to
excessive controls impacting the bottom line or
ineffective safeguards leaving an organization
exposed to risks. Planning strategically can provide
integration of the business process controls
(compliance policies, system controls, audit tests),
application and security controls (segregation of
duties, authentication and authorization controls)
and infrastructure controls (database security,
encryption) into a single and comprehensive controls
monitoring solution. Ideally, this solution should be
tailored to fit an organization’s unique culture and
risk appetite.
3 ACHIEVING A UNIFIED VIEW
TOWARDS RISK
The greatest challenge in constructing a unified and
holistic approach to ICT risk is not just the gathering
of similar information within an organization but
instead the failure to correlate successfully different
information outside the scope of business operations.
In response to the changing risk environment that
defines modern business operations, new risk
approaches to information security infrastructure
have to be developed. Previous security management
models (Soo Hoo, 2000) have focused on
demonstrating in a structured way the factors
affecting compliance and risk procedures by
allocating responsibilities according to duties.
However, many of them have failed to fulfil the
expectations of ongoing compliance pressures and
evolving challenges. The reasons for failing can be
SECRYPT 2010 - International Conference on Security and Cryptography
460