IS Security and Risk Management: Services, Controls, and Techniques by Novo IT

This report discusses the services offered by Novo IT, general management controls, application controls, risk management techniques, and significance of data quality and auditing in the field of IS security and risk management. The comparison between general management control and application control is also made. The subject, course code, course name, and university are not mentioned.

IS Security and Risk Management

1 | P a g e
Table of Contents
Introduction...........................................................................................................................................1
Services offered by an organisation.......................................................................................................1
General management controls...............................................................................................................2
Application control used by Novo IT....................................................................................................3
Comparing general management control with application control for IS..............................................4
Risk management techniques................................................................................................................5
Significance of the data quality and auditing in the field of IS...............................................................5
Conclusion.............................................................................................................................................6
References.............................................................................................................................................8

2 | P a g e
Introduction
Novo IT is one of the successful Australian organisations that support the employees
for outsourcing their services and providing ways through which communication can become
easy. They have offered great opportunities so that multiple businesses can operate in a
secured way. In this report the service that novo IT are discussed. Apart from this, the general
management control and application control of the organisation is discussed. The risk
associated with this service and found and the mitigation ways are found.
Services offered by an organisation
Novo IT offers a wide range of service such as the platform of the Remote Monitoring
and Management to continually monitor the health and performance of your IT network. It
also provides the services of the early detection and remediation of the issues before the
occurrence of the down time or data loss (Liu, Miura & Ise, 2016). Novo IT also provides
the reports about the entire internal system of the IT. This also includes the business value
and helps the customers and the users to plan and budget the future of the IT expenditure.
The services also include managing the infrastructure to avail the benefits of the maximum
reliability of the wireless networks. Apart from this facility of the managed desktop by the
user and the enhanced security to protect the data round the clock this means 24 hours. The
application management feature if the Novo IT also ensures the reliability of the business
applications to avoid the costly engagements (Prentice, Bills & Peters, 2018). It provides the
strategic advice to transform the business with the highly skilled expertise and through sound
process management. Moreover the company (Simon, Yaya, Karapetrovic & Casadesús,
2014).Moreover the Novo IT also manages the cloud computing business and smarter
solutions are provided to the users so they can access the data with ease.

3 | P a g e
General management controls
Management controls are used by the employees and the managers to accomplish and
identify the objectives and goals of the organisations. The major reason of the introduction of
the management controls by the Novo IT is to protect the data of the users from unauthorised
access and from the viruses. There are basically two types of control the preventive control
and the detective controls. The preventive controls are designed to discard the errors and the
irregularities and the detective controls are formulated to identify an error or irregularity.
There is no certain list of the controls however; the company addresses three types of major
controls (Leimbach, Adams, Swensgard & Overmyer, 2015). Input controls are formed to
check whether the transactions have been recorded accurately or not and also to check
whether they have been properly authorised or not. Processing controls on the contrary are
undertaken to analyse whether the transactions have been performed as decided. Output
controls are the controls which decide the accuracy of the result. Problem management and
the technical controls to identify and address the root cause of the technological error if any
and to perform more efficiently (Iwu, Ogbonna, Jude & Onuma, 2014). Majorly the data is
stored in the cloud and therefore, to protect and maintain the confidentiality the users are
provided the hi-tech security. These types of controls are implemented generally when
particularly a new system is implemented. These controls are extremely important for the
Novo IT to monitor the impact of the working in the organisation (Mustapha, Manan &
Alwi, 2017). The general management controls come into the action to increase the
performance of the business by detecting the frauds and errors by the internal as well as the
external people (Torras, et. al, 2018).

4 | P a g e
Application control used by Novo IT
The general control measure and the application control differ from each other.
Application controls are used to secure a particular application or a process. There are various
application controls that are defined by an organisation. The application control makes sure
that there are no bugs in the system (Simon, Yaya, Karapetrovic & Casadesús, 2014).
The application controls that are used by an organisation to maintain the security are
input controls, output controls, processing controls and auditing controls. Input controls are
used to check that the information is accurate and correct. The output controls are checked by
comparing the desired result with the actual result. If there is any difference in the output
obtained. It could be found that there are bugs in the system so that action plans could be
defined (van Kesteren, Cubadda, Bouwmeester, van Eijkeren, Dekkers, de Jong & Oomen,
2015). The processing control checks that the information which is entered in the system is
complete and can be processed. The processing controls are used to check that the operations
will be carried out only by valid users. The unauthorised users cannot access the operations
so there are chances of security breach. One of the most important application controls is
audit control as it monitors all the actions. It helps in finding out the bugs that exist in the
software s that error could be removed. Application controls make sure that all the operations
are secured and errors do not penetrate in the system (Lorencatto, et. al, 2016).
The application control is important as they adapt to the changes automatically. Every
time whenever there is a change in database, software or any application these controls adapt
to changes. Every organisation can rely completely on the security by using application
control. Thus every organisation relies on application control for meeting the security needs
(Costan & Popa, 2017). Like in case, of Novo IT security of the network is maintained using

5 | P a g e
application control. They make sure that while information is transferred on the network
security and privacy of data is maintained (Saha, Mollah, Alam & Rahman, 2016). The
security measures are inherited in the application control they make sure that software’s are
updated regularly. They assure that information is accessed only by authorised user; no
invalid user can access the information. The data packets should remain confidential and it
should not be leaked.
Comparing general management control with application control for
IS
There is a difference between both the control measures, though both of them deal
with maintain the security of the network. The application control is used to make sure that
application and processes are secure and are accessed by a valid user. On the other hand,
general management control is used to see who can access the data and how to maintain
privacy and confidentiality of the system (Vojinovic, et. al, 2016). On the other hand,
application control checks weather an application is working correctly, the processes are
updated and error free or not. The security of a particular organisation is dependent on both
the control. If comparing both these, general control deal with the entire network and the
application control deals with a particular area. The security plans are designed to make sure
that confidential and reliability is maintained (Kerzner & Kerzner, 2017). This can be
achieved by working on the pre-defined rules. The operations related to IS are observed by
the application control. The general management control is used to manage all the conflicts at
the workplace. The primary objective is to make sure that all the operations are completed
without any failures. The application control checks that the inputs are valid and can be
processed accurately without any error. If comparing both the control measures in Novo IT, it
was found that GMCs work in all the area where as ACs are applicable to a small area. They

6 | P a g e
are applied in a specific area to make sure that the integrity, confidentiality and availability of
information is maintained.
Risk management techniques
The risk associated with every organisation is security breach. Thus, every
organisation designs policies to make sure that confidentiality, availability, reliability and
integrity of data is maintained. The security of an organisation aims in securing the data so
that privacy of data packet is not breached. Apart from that, it is necessary to maintain the
integrity the confidentiality of data (Kerzner & Kerzner, 2017). That assures that information
is readable only to valid user and no unauthorised person have a right to access the data. This
is achieved by maintaining an access list so that privacy of data is not violated. The risk
management techniques make sure that that even in case of failure the network continues to
work. It makes sure that consistency of operations is maintained. For, maintaining the
reliability the every organisation has a backup plan designed (Kosma, Lambropoulou &
Albanis, 2014). The first step, of risk management plan is identifying the bugs so that they do
not penetrate in the system. The risk is accessed and the source of the risk is found so that
control plan is developed for future security.
Significance of the data quality and auditing in the field of IS
Data Quality is what the company maintains and it is the only factor on which the
company depends and performs. It builds a trustworthy relationship between the clients and
the company. Basically the data quality improves the standard of the content and helps to
mitigate the risks. This process creates a transparent environment in the company and all the
changes such as the transactional or the structural changes are reflected easily (Kosma,
Lambropoulou & Albanis, 2014).

7 | P a g e
Auditing on the other hand is another tool which is like a reflection of the company’s doings.
The organisations collect the data from different sources and moreover there are numerous
clients who keep the confidential data online therefore, there are chances that the few of the
data sets can deluge and may be harmful for the company as well as other clients (Brown,
2015).
There are several benefits which are underlined below describing the significance of the data
quality and the importance of the auditing in the field of IS.
The quality of the data gets verified and it also helps to find out the loopholes if any. The
customer are also becoming quality conscious and they are ready to pay more in terms of
quality rather than the quantity therefore adopting the practice of the data quality and the
auditing gives a boost in accepting the customer’ needs and preferences.
Owing to the rapid diffusion and the pace in the technology the companies rely on the digital
media but however, there are still chances of loss and theft of the important data or the
embezzlement and manipulation therefore auditing acts as a saviour and the scanner in
scanning the problem areas and same are communicated to the management so that the
management can take the necessary actions on time.
Further, since the data is over the internet the chances of the errors are low yet the data
quality and auditing provides and additional cover and this methodology can make the
working easy and the company like Novo IT can grab better opportunities.
Conclusion
Form the above analysis on the importance it can be observed that all the services which are
provided by the Novo It being an information technology company require general controls
to operate efficiently as well as effectively. Moreover the discussion on the business

8 | P a g e
operations that support the organisation depicts the basic features which are also a vital part.
The applications controls used by the Novo IT are an asset to the company and it is advised to
the company to conduct the audit checks regularly and to maintain a high quality of the data
in order to avoid any kind of variances between the benchmark and the performances. The
risk management techniques followed by the company aims to deliver the core services and
the privacy of the data which also builds the customer satisfaction and stabilize the market
position of the company. Henceforth, the Novo IT can achieve the vision and can set trends if
the quality and the performance if the company remains consistent and improves with extra
features and dimensions.

9 | P a g e
References
Brown, S. A., Phillips, J., Barnes, C., Curtin, J., McRae, S., Ockelford, P., ... & Dunkley, S.
(2015). Challenges in hemophilia care in Australia and New Zealand. Current
medical research and opinion, 31(11), 1985-1991.
Costan, L., & Popa, S. (2017, May). The company's internal audit seen as a piece of a
complex system. In Control Systems and Computer Science (CSCS), 2017 21st
International Conference on (pp. 371-374). IEEE.
Iwu, H. C., Ogbonna, C. J., Jude, O., & Onuma, K. G. (2014). Application of Inventory
Model in Determining Stock Control in an Organization. American Journal of Applied
Mathematics and Statistics, 2(5), 307-317.
Kerzner, H., & Kerzner, H. R. (2017). Project management: a systems approach to planning,
scheduling, and controlling. John Wiley & Sons.
Kosma, C. I., Lambropoulou, D. A., & Albanis, T. A. (2014). Investigation of PPCPs in
wastewater treatment plants in Greece: occurrence, removal and environmental risk
assessment. Science of the total environment, 466, 421-438.
Leimbach, R. L., Adams, S. R., Swensgard, B. E., & Overmyer, M. D. (2015). U.S. Patent
Application No. 14/226,117.
Liu, J., Miura, Y., & Ise, T. (2016). Comparison of dynamic characteristics between virtual
synchronous generator and droop control in inverter-based distributed
generators. IEEE Trans. Power Electron, 31(5), 3600-3611.

10 | P a g e
Lorencatto, F., Gould, N. J., McIntyre, S. A., During, C., Bird, J., Walwyn, R., ... & Foy, R.
(2016). A multidimensional approach to assessing intervention fidelity in a process
evaluation of audit and feedback interventions to reduce unnecessary blood
transfusions: a study protocol. Implementation Science, 11(1), 163.
Mustapha, M. A., Manan, Z. A., & Alwi, S. R. W. (2017). Sustainable Green Management
System (SGMS)–An integrated approach towards organisational
sustainability. Journal of Cleaner Production, 146, 158-172.
Prentice, J., Bills, K. L., & Peters, G. F. (2018). The Impact of Benefit Plan Audits on
Financial Statement Auditor Choice and Financial Statement Audit Quality, 56-90.
Saha, N., Mollah, M. Z. I., Alam, M. F., & Rahman, M. S. (2016). Seasonal investigation of
heavy metals in marine fishes captured from the Bay of Bengal and the implications
for human health risk assessment. Food Control, 70, 110-118.
Simon, A., Yaya, L. H. P., Karapetrovic, S., & Casadesús, M. (2014). An empirical analysis
of the integration of internal and external management system audits. Journal of
Cleaner Production, 66, 499-506.
Torras, M. G., Canals, E., Jurado-Bruggeman, D., Marín-Borras, S., Macià, M., Jové, J., ... &
Puigdemont, M. (2018). Clinical Audit of the Radiotherapy Process in Rectal Cancer:
Clinical Practice Guidelines and Quality Certification Do Not Avert Variability in
Clinical Practice. Translational oncology, 11(3), 794-799.
van Kesteren, P. C., Cubadda, F., Bouwmeester, H., van Eijkeren, J. C., Dekkers, S., de Jong,
W. H., & Oomen, A. G. (2015). Novel insights into the risk assessment of the
nanomaterial synthetic amorphous silica, additive E551, in
food. Nanotoxicology, 9(4), 442-452.

11 | P a g e
Vojinovic, Z., Hammond, M., Golub, D., Hirunsalee, S., Weesakul, S., Meesuk, V., ... &
Abbott, M. (2016). Holistic approach to flood risk assessment in areas with cultural
heritage: a practical application in Ayutthaya, Thailand. Natural Hazards, 81(1), 589-
616.