Rationalize control objectives and controls

Organizations with the least loss and theft of sensitive data audit implement fewer, risk-relevant, control objectives (policies) than all other firms.  In addition, the leaders implement more controls, between three and four times more, than the number of control objectives (Figure 1).

Figure 1: Audit more business functions

Source: IT Policy Compliance Group, 2007

Guidance recommendations

If your control objectives are not focused on core business and regulatory risk, then they are candidates for a diet.  If there are not enough procedural and technical controls to implement policies, then it’s likely time to put some teeth into policies.  Based on the benchmark results, the optimums include:

·       30 control objectives

·       105 procedural and technical controls

·       3.5 more controls than objectives

© IT Policy Compliance Group, 2007