IS Security and Risk Management: IS security enforcement in Woolworths Limited

This report identifies the IS system and its usage in Woolworths Limited, along with the risks and security issues and accurate recommendations to mitigate them. It also discusses the general management controls, application controls, and their comparison, as well as risk management techniques and audit plan and process.

Running head: IS SECURITY AND RISK MANAGEMENT
IS Security and Risk Management: IS security enforcement in Woolworths Limited
Name of the student:
Name of the university:

1IS SECURITY AND RISK MANAGEMENT
1. Introduction
1.1 Aim
In this current era of technology Information System (IS) has become one of the most
important technologies which is widely used by the business owners for high level business
success. The aim of the report is to identify the IS system and its usage in Woolworths Limited.
In order to run a business successfully, business requires quality level information systems for
processing all financial and organizational data statistically. Even after adoption of these
particular approaches certain issues are raised those are needed to be mitigated accordingly.
Based on those risks and security issues accurate recommendations are also mentioned in this
report.
1.2 Objectives
The objectives of the report are as follows:
 To identify the IS implementation issues of Woolworth Limited, due to which it
has come across the information management problems regarding accuracy,
flexibility and reliability that interrupts the general workflow of an organization
 To identify the general management control, application control and respectively
their comparison
 To identify the importance of IS auditing, risk management implementation
techniques

2IS SECURITY AND RISK MANAGEMENT
 To investigate the risks and accordingly assessment of risks, and development of
risk control approaches
2. A depiction of the services Woolworths Limited provide
Woolworths Limited is one of the most famous Australian grocery shops whose brand
value has reached across $10.8 Billion. It has raced ahead of its rival Coles in the brand value
stakes, based on to a valuation of the world’s top brand. Currently, the supermarket worth is
more than around $10 Billion (Laudon and Laudon 2015). The mission of the company is to
deliver best valued, quality and convenience products and convenience to their consumers’
allover Australia. It has around 3000 stores and 205,000 team members who serve over 29
million of consumers all over Australia (Kerzne and Kerzner 2017). Woolworths Limited is one
of the most trusted brands of Australia among the local farms and manufacturers.
2.1 The way through which the information system supports the organization
business operations
At the business initiation phase the company has manual data management system. In
case of manual data management the rate of manmade error and security issues were highly
pointed out. Woolworths deals with selling fresh food products, petroleum and liquor as well and
operates in home environment (Galliers and Leidner 2014). The organizational structure of the
company is consists of board of directors, management boards, and members of the management
committee. Due to lack of technical approaches and managerial aspects Woolworths Limited had
started facing several challenges. Due to quality products and reliable services, the numbers of
consumers are also growing for Woolworth as a result the amounts of information are also
growing accordingly (Power, Sharda and Burstein 2015.). In order to manage large set of

3IS SECURITY AND RISK MANAGEMENT
information Woolworths implemented Information System in terms of Enterprise Resource
Planning (ERP). After adopting IS the benefits that could be obtained are as follows:
 It gives real time integrated data
 Provides better communication platform to the employees and consumers as well
 Reduces the rate of risk and other errors
 Gives better security and high rage of productivity
3. General Management Controls (GMCs) of Woolworths Limited
In order to achieve brand success and commercial growth most of the large organizations
develops and maintains business strategies and goals. Like other Woolworths Limited is also
consists of resources, human and non-human which helps to increase its production and
rendering services (Rose, Hawryszkiewycz and Kang 2015). The management control system of
Woolworths is consists of action control, administration, duty separation, acceptable action
definition etc. the sole of the organization is the action decision maker. The role of the
management board forms part of these identified elements. The decisions taken by the
management board influence the actions of other employees (von Briel and Recker 2017).
Besides this, it involves different units those are not each time required similar management.
In order to implement the functions effectively separate duties are allotted to separate
employees. Remuneration is the award facility used in the company. In order to increase the
skills and knowledge of the working employees Woolworths organizes training and development
programs (Kavanagh and Johnson 2017). The higher authority of Woolworths allots resources in
accurate places and the HR ensures that the allocation is fairly done. It can eventually control

4IS SECURITY AND RISK MANAGEMENT
the performance and helps to take relevant actions for it. GMCs have its own dimension that
shows all extent at which a management control system has impact over their employees.
4. Types of Application Controls (ACs)
Different kinds of Application Control Systems (ACs) are available and according to and
based on the background various companies adopt various Control systems (Denolf et al. 2015).
ACs is referred to as a security practice that helps to restrict the unauthorized applications that
may put data in high level risks. Based on specific business functionalities and applications
business purposes can be pointed out and also reach the business objectives (Juan Ding et al.
2014). ACs includes completeness, validity checking, identification, authentication,
authorization, controlled inputs, forensic control etc. The details of some of the ACs are
elaborated in the below section:
Completeness checking: From initiation to final completion this approach helps to
ensure the records processing.
Validity checking: This ensures only the input or process of valid information
Identification: It makes sure the unique, irrefutable identification of the users associated
to the business organization (Belanger et al. 2014)
Authentication: It provides authentication mechanism
Authorization: It ensures that only the authorized users can access information from the
server

5IS SECURITY AND RISK MANAGEMENT
Input control: Make sure that from the upstream sources the data integrity feed into the
system of application
5. Compare general management controls and application controls for IS
Woolworths Limited has adopted Information System (IS) for supporting their decision
and resolving all the identified issues accordingly.
General Management Control (GMCs) deals with operational and functional activities
whereas the ACs deals with all the policies and procedures of ARE applications served by an
organization. General control is referred to as policies and procedures that are related to many
applications. It also supports the effective functionalities of application control system that helps
to ensuring the operation of the Information system (Luiten et al. 2016). This control applies to
the organizational mainframe, servers etc. The functionalities of GCs are as follows:
 It gives proper control over the data centre and other network operation
 It deals with system software acquisition, change management and maintenance
 It deals with security
 Provides authorization to access to the computer programs and also other data
files (Aakhus et al. 2014)
 Gives physical security to assets and other records
Almost each large to medium organizations uses some of the ERP systems such as
automated financial reporting system etc. The reliability and accuracy of the economic reports
are completely dependent on large extent over the IT control system used by different business
organization.

6IS SECURITY AND RISK MANAGEMENT
On the other hand, IT ACs controls specific software application and individual
transaction as well (Kerzner and Kerzner 2017). In order to control business operations and
functions different policies and practices are applied by the business organizations. For enacting
these policies, procedures to restrict the access all the general ledger software package needs all
necessary functionalities. The ACs accesses are strictly important and required to be reviewed as
a part of the certification process (Power, Sharda and Burstein 2015). IT application used to
monitor and control huge set of information properly. It also helps to review the modification
over product prices periodically. Furthermore it can be said that, the data access should be
restricted among the authorized users.
6. Risk management techniques
As Information system is an advanced technological excellence thus due to lack of
different managerial approaches the company is facing major risks in their business ongoing
phase (Morioka, Evans and de Carvalho 2016). It is necessary for the business organization to
develop an accurate risk management plan to avoid the unwanted risks.
a. The risk management techniques adopted
Reliability: Data reliability is a data collection technique that ensures the consistency of
information set over the distributed environment. The IS used by Woolworths is reliable in
nature.
Confidentiality: Woolworths uses proper mechanisms to restrict unwanted data access
from server. This feature ensures that the sensitive information is not hijacked by
unauthenticated users (Denolf et al. 2015).

7IS SECURITY AND RISK MANAGEMENT
Availability: It ensures that all required information is available to the employees for the
organizational usage (Abunar and Zerban 2016)
Integrity: This fundamental component is referred to as the accuracy and the consistency
of data stored in the server, warehouse.
Security: Woolworths uses firewall and DMZ to restrict unwanted data access.
b. The other risk management approaches
Risk identification: Apart from these, Woolworths has proper risk identification
techniques as well through which they can identify the risks from the initiation up to the
completion of any project.
Risk assessment: After identifying the risks proper risk assessments approaches are also
implemented by Woolworths (Kavanagh and Johnson 2017). With the help of these approaches
the company will be able to give priority to the risks.
Risk control: After pointing risk according to their priority proper risk control
approaches are also elaborated by Woolworths Limited.
7. Audit plan and audit process
For any business organization audit plan audit processing are very important components
to be implemented. Based on the basic requirements proper audit plan is needed to be
implemented by the business organization. It is the responsibility of the finance manager to make
effective audit planning as it also helps to safeguard the data quality (von Briel and Recker
2017). In order to achieve the business objectives, reliable financial reports are needed and that

8IS SECURITY AND RISK MANAGEMENT
are also developed by the business organizations easily with the help of audit planning and
processing it (von Briel and Recker 2017). Frauds can be prevented and costs of total capitals are
also reduced with the feasibility study and proper IS audit planning and processing. It helps to
identify the cost for each resources and materials also.
8. Conclusions and Recommendations
From the overall discussion it can be concluded that, Information System and
Information Technology have brought revolutionary changes in the business organization to gain
competitive advantages and economical revenue. Even in case of organizational capital
investment IS has become the largest component. From the company survey it has been found
that, Woolworths Limited has invested over 50% of its total investment in the IS development.
With the help of IS, company can create secure and strong relationship between the consumers
and other service providers. The key corporate assets for this company are intellectual properties,
core competencies, financial and human assets etc. The core business processes of Woolworths
Limited have also changed in terms of business task, digital network after the adoption of
Information system to their business. In addition to this, different types of application control,
general management control and their comparisons are also mentioned in this report. Besides
these benefits certain challenges are also associated to it those are needed to be resolved. The list
of the recommendations regarding security and risk management are mentioned below.
Recommendations
Encryption: Encryption is referred to as one of the most important technologies that must
be used by the business organizations to ensure the security of the asset. Encryption is done with
the help of a key that can encode information and on the other hand that particular information

9IS SECURITY AND RISK MANAGEMENT
cannot be decoded with the relevant key. The private key should never be shared among the third
parties.
Firewall: Firewall is another security approach ensures the security of the organizational
confidential data. It order to gain competitive as well as commercial success from the market
over other companies, Woolworths Limited should adopt application firewall for their company
to avoid unwanted data fetch.
Risk register: Risk register is another important approach that Woolworth Limited
should adopt by identifying the risks and their according risk mitigation approaches. It will help
the business organization to ensure company reliability, flexibility, data availability, and integrity
and data security as well. Collectively it can be said that, risk register is an important approach
to control unwanted activities in the business organization.

10IS SECURITY AND RISK MANAGEMENT
References
Aakhus, M., Ågerfalk, P.J., Lyytinen, K. and Te'eni, D., 2014. Symbolic action research in
information systems: introduction to the special issue. Mis Quarterly, 38(4), pp.1187-1200.
Abunar, S.M. and Zerban, A.M., 2016. Enhancing Accounting Information Systems to Facilitate
Supply Chain Management between Supermarkets/Suppliers: The case of Saudi Arabia. Journal
of Accounting & Marketing, 5(2), pp.1-7.
Belanger, F., Cefaratti, M., Carte, T. and Markham, S.E., 2014. Multilevel research in
information systems: Concepts, strategies, problems, and pitfalls. Journal of the Association for
Information Systems, 15(9), p.614.
Cassidy, A., 2016. A practical guide to information systems strategic planning. CRC press.
Denolf, J.M., Trienekens, J.H., Wognum, P.N., van der Vorst, J.G. and Omta, S.O., 2015.
Towards a framework of critical success factors for implementing supply chain information
systems. Computers in Industry, 68, pp.16-26.
Galliers, R.D. and Leidner, D.E. eds., 2014. Strategic information management: challenges and
strategies in managing information systems. Routledge.
Juan Ding, M., Jie, F., A. Parton, K. and J. Matanda, M., 2014. Relationships between quality of
information sharing and supply chain food quality in the Australian beef processing industry. The
international journal of logistics management, 25(1), pp.85-108.
Kavanagh, M.J. and Johnson, R.D. eds., 2017. Human resource information systems: Basics,
applications, and future directions. Sage Publications. Kavanagh, M.J. and Johnson, R.D. eds.,

11IS SECURITY AND RISK MANAGEMENT
2017. Human resource information systems: Basics, applications, and future directions. Sage
Publications.
Kerzner, H. and Kerzner, H.R., 2017. Project management: a systems approach to planning,
scheduling, and controlling. John Wiley & Sons.
Laudon, K.C. and Laudon, J.P., 2015. Management Information Systems: Managing the Digital
Firm Plus MyMISLab with Pearson eText--Access Card Package. Prentice Hall Press.
Luiten, C.M., Steenhuis, I.H., Eyles, H., Mhurchu, C.N. and Waterlander, W.E., 2016. Ultra-
processed foods have the worst nutrient profile, yet they are the most available packaged
products in a sample of New Zealand supermarkets. Public health nutrition, 19(3), pp.530-538.
Morioka, S.N., Evans, S. and de Carvalho, M.M., 2016. Sustainable business model innovation:
exploring evidences in sustainability reporting. Procedia CIRP, 40, pp.659-667.
Pearlson, K.E., Saunders, C.S. and Galletta, D.F., 2016. Managing and Using Information
Systems, Binder Ready Version: A Strategic Approach. John Wiley & Sons.
Power, D.J., Sharda, R. and Burstein, F., 2015. Decision support systems. John Wiley & Sons,
Ltd.
Rose, J., Hawryszkiewycz, I. and Kang, K., 2015, July. Evaluating Information Systems for
Collaborative Wellness. In Pacific Asia Conference on Information Systems. AIS.
von Briel, F. and Recker, J.C., 2017. Lessons from a failed implementation of an online open
innovation community in an innovative organization. MIS Quarterly Executive, 16(1), pp.35-46.