Control and management in complex information systems

Abstract

Management has to decide what to reasonably invest for security and control in IT and how to balance risk and control investment in an often unpredictable IT environment. While information systems security and control help manage risks, they do not eliminate them. In addition, the exact level of risk can never be known since there is always some degree of uncertainty. Ultimately, management must decide on the level of risk it is willing to accept. Judging what level can be tolerated especially when weighted against cost, can be a difficult management decision. Therefore, management clearly needs a framework of generally accepted IT security and control practices to benchmark their existing and planned IT environment. Ever since MIS (Management Information Systems) began to appear and be absorbed more widely into the corporate framework, anecdotal accounts have persisted of user dissatisfaction, especially with the lack of systems responsiveness to user needs. Computer assistance has traditionally been designed around particular functions, for example transaction processing, messaging, remote task execution and high level planning aids. This support has tended to evolve as a response to the particular needs of relatively isolated functional domains and the technical response has consequently been targeted towards providing limited, local solutions.