Administrative Controls

How do Administrative Controls Demonstrate Due Care

Administrative controls entail several items including procedures, written policies, specific principles, guidelines, and trainings that are established to control the actions of individuals. Administrative controls actually classify the human factors of security and encompass every level of personnel within a company. This is how access is decided for every user; it’s based on the needs of the business. In terms of due care, this is a reflection of responsibility a company has taken for their actions within their company to provide the necessary protection. Due care is evident through specific controls established to confirm management is cognizant of the activities in their company. For example, I work for a healthcare company and controls are set in place to block all social networking sites from being accessed on the company network. This provides protection for the employees from accessing non-company related materials and it decreases the company’s chances malicious activity caused by accessing those sites. We also participate in employee trainings, which is also considered an administrative control. This is considered due care because we are trained to understand policies and procedures. When we start all training sessions, there are forms we have to complete stating that we are entering a specific course and we receive documentation at the end of the training session to reflect we have completed the course. All of these controls exhibit individual accountability and separation of duty, which is extremely important to consider in terms of controls.

How Does the Absence of Administrative Controls Impact Corporate Liability

The absence of administrative controls will certainly reflect a negative connotation on corporate liability. This is a direct reflection on the company and their lack of due diligence by not implementing the proper controls to create a sound work environment. When proper controls are not executed, the company is highly susceptible to lawsuits and fines for breach of security or safety. For example, my job contains many employees that deal with extremely sensitive information pertaining to our valued members. Many of our Case Managers work closely with members on Medicare and Medicaid. The documentation for these members are very detailed in terms of their conditions, treatments, and action plans. This information is protected by the company network and several methods of verification have to be entered in order to gain access to this information. If the proper controls were not set in place to protect the information of the members, it could be accessed easily by an outside source and it would be devastating for our company to have this information released publicly. This would lead to our company being held liable for information being leaked and it could cause significant fines along with a very damaging reputation. As a healthcare company, we are mandated with the responsibility of protecting the sensitive information of our members by ensuring the proper controls are set in place that will allow us to deliver the protection we promote. This is another reason why all workers are encouraged to only use printed materials with members’ information only when absolutely necessary. We are highly encouraged to utilize all our resources on our company devices to avoid paperwork landing in the wrong hands. However, leaving sensitive member information out and available for anybody to gain access to would fall in the category of negligence and carelessness from the user as opposed to the company. Although, it would be the fault of the user, the company would still be negatively impacted.

How do Administrative Controls Influence the Choice of the Technical and Physical Controls

Administrative controls play an essential role in the influence of the choice of technical and physical controls. Although the technical and physical controls are extremely critical, they completely rely on the establishment of administrative controls that have already been established. Administrative controls determine the procedures and measures; on the other hand, physical and technical controls are the materials and systems that are necessary in executing the procedures. The administrative controls actually decipher the state of a physical or technical control. For example, when you come into my office building, there are several entry points to the actual building, but you need an ID card to get into the workspaces. This is set in place to protect the access to company devices with sensitive member information. If the proper control measures are not are not in place to safeguard this information, then the physical controls such as the ones that allow us entry with our ID badges have absolutely no meaning. This is similar to having your doors locked on your car, but the windows are down. The doors are locked, but the items in your ear are easily accessible because the windows are down.
How Would the Absence of Administrative Controls Affect Projects in the IT Department

The absence of administrative controls will severely affect projects in the IT department.

These projects are highly sensitive and have many concerns when it comes to stored information. The majority of this information should be restricted and only intended for designated users in the IT department. This is why it is so critical for administrative controls to be established; in effort to control the users accessing certain information. When the administrative controls are absent, critical information can be exposed which would put the project in jeopardy. Having the proper controls in place is a direct reflection on the overall success of the project. When the administrative controls are absent, limitations are placed on the IT department, which makes it virtually impossible to complete their tasks. This is another circumstance of how a company could have legal action taken against them from lack of administrative controls. Unfortunately, certain legal actions might have a large impact on the company and they might not be able to recover. The proper administrative measure will increase the probability of success.

References Tierney, C. E. (2006). OMB Circular A-123 and Sarbanes-Oxley: Management’s Responsibility for Internal Control in Federal Agencies. Hoboken, NJ: J, Wiley Huang, W., Siau, K., & Wei, K. K. (2005). Electronic Government Strategies and Implementation. Hershey, PA: Idea Group Pub Lahti, C. B. (2007). Sarbanes-Oxley Compliance Using Open Source Tools. Burlington, MA: Syngress Publishing, Inc.