SBM4304 - Analyzing IS Security and Risk Management at Telstra

This essay provides a detailed analysis of Telstra's information system security and risk management practices. It begins by illustrating the services Telstra provides and how its information system supports business operations. The essay then outlines and discusses Telstra's General Management Controls (GMCs), which form the foundation of its internal control system, and explores the different types of Application Controls (ACs) used to secure computerized applications. A comparison of GMCs and ACs highlights their distinct roles in information system management. Furthermore, the essay examines the risk management techniques employed by Telstra, focusing on ensuring reliability, confidentiality, availability, integrity, and security through avoidance and loss prevention. It also addresses risk identification, assessment, and control using loss reduction and separation techniques. Finally, the essay emphasizes the importance of auditing Telstra's information system and outlines the organization's audit plan and process, concluding with recommendations for enhancing IS security.

Running head: BUSINESS INFORMATION SYSTEM
Business Information System: Telstra Organization
Name of the Student
Name of the University
Author’s Note:

1
BUSINESS INFORMATION SYSTEM
Table of Contents
1. Introduction............................................................................................................................2
2. Depiction of Services and Use of Information System..........................................................2
3. General Management Controls..............................................................................................4
4. Types of Application Controls...............................................................................................4
5. Comparison of GMCs and ACs for Information System.......................................................6
6. Risk Management Techniques...............................................................................................7
a. Reliability, Confidentiality, Availability, Integrity and Security.......................................7
b. Risk Identification, Risk Assessment and Risk Control....................................................7
7. Importance of Auditing Information System.........................................................................8
8. Conclusion and Recommendations........................................................................................9
9. References............................................................................................................................10

2
BUSINESS INFORMATION SYSTEM
1. Introduction
Information system is the organized system for successfully collecting, organizing,
storing as well as communicating any typical information or data. Information system is the
set of various components, which eventually interact with each other for producing proper
information (Laudon and Laudon 2015). The focus of information system is on the internal
data and not on the external data. This type of information systems are utilized by all
organizations in today’s world. The main aim is to make the services and functions of the
organization, extremely easier, smoother and technology oriented.
The following report outlines a brief discussion on the entire concept of information
systems and information system services in a particular organization. The chosen
organization in this particular report is Telstra Telecommunications Company of Australia.
This report clearly depicts about the information system services and the utilization of this
system within the organization. The several General Management Controls or the GMCs will
also be mentioned here. The Application Controls used by Telstra and the proper comparison
between GMCs and ACs will be explained in this report. The various risk management
techniques that Telstra had adopted will also be given here. Moreover, this report further
demonstrates about the audit plan undertaken by the organization.
2. Depiction of Services and Use of Information System
Telstra Corporation Ltd. or simply Telstra is the most popular telecommunications
organizations in Australia. It solely builds as well as operates all types of networks of
telecommunications, market voices, internet accessibility, television and many more. There
are various other services and goods that are produced by the company (Telstra.com.au.
2018). In the recent survey, it had been noticed that Telstra provides 17.6 million mobile

3
BUSINESS INFORMATION SYSTEM
services, 5.1 million retail fixed voice services and 3.5 million retail fixed broadband services
to Australia. They are supposed to bring and they have the aim to produce an excellent
connected future for each and everyone. They want to provide information system services to
its customers as well as employees in such a way that they do not suffer from any type of
network distortion.
Information system is the proper set or collection of components that are utilized for
making the functions and services of nay business extremely simple and without complexities
(Stair and Reynolds 2013). Information system plays the most significant role in any type of
business operations. This particular system is responsible for making the business operation
extremely successful and well accepted by all customers. Telstra is responsible for providing
all types of network related services for their customers. Any services that are related to
telecommunications are provided by this particular organization (Venkatesh, Brown and Bala
2013). Moreover, this particular organization has to deal with various confidential as well as
bulk amount of data or information. The most important advantages of information system in
any particular organization are to build up the communication. Since, Telstra is a
telecommunications company, communication is the main factor in their organization. The
customers should have a good relation with the organization so that it is successful in its
business operations. The next important advantage is the vast availability. The organization is
open for 24*7 and a customer support is present to answer all the queries of the customers.
Information system can help in this particular scenario as they make the system and the
organization available all the time for their customers (Galliers and Leidner 2014). Moreover,
the cultural gaps are diminished and the globalization is enhanced within the business. Thus,
information system is very important for Telstra organization.

4
BUSINESS INFORMATION SYSTEM
3. General Management Controls
The GMCs or the General Management Controls are certain management controls
that are undertaken by any organizational managers as well as employees to accomplish all
the recognized goals and objectives of that organization (Davies, Dean and Ball 2013). These
management controls are various operational methods, which enable the work for proceeding
as planned by the management. The general management controls solely and effectively
influence the total behaviour of the organizational resources for successfully implementing
the various organizational strategies. The first and the most important criteria for
implementing general management controls or GMCs within an organization is for mitigating
the organizational risks and threats (Pearlson, Saunders and Galletta 2016). This particular
control eventually forms the complete foundation of the internal control systems and thus
helping the organization to provide with efficient defence against the threats.
The General Management Controls of the organization of Telstra is based on the three
important components. They are the setting of standards, measuring the actual performance
and taking corrective action (Rainer et al. 2013). The GMCs of this particular organization
mainly include maintaining excellent relation with the customers and this helps to maintain
the customer relationship management. The second GMC of the Telstra organization is
providing proper training to all the employees so that they understand the importance of the
job (Petter, DeLone and McLean 2013). The third GMC of Telstra mainly involves the
compliance with laws and the integrity, competence and attitude. This helps to attain the
organizational goals and objectives.
4. Types of Application Controls
Application control can be defined as the security practice, which helps in blocking or
restricting all types of unauthorized applications from properly executing in various methods

5
BUSINESS INFORMATION SYSTEM
(Power, Sharda and Burstein 2015). These methods are such methods that are responsible for
putting the data at risk. The application control mainly involves the validity checking,
identification, completeness checking, input controls, authorization as well as forensic
controls. These controls are distinct types of controls that are utilized by all organizations for
controlling the computerized applications like the online learning systems, payroll systems or
any other important business related applications (Cassidy 2016). Telstra utilizes various
types of application controls within their organizations. The various types of application
controls mainly include:
i) Completeness Checking: This type of application control helps in controlling the
ensured record processing from starting till the end.
ii) Validity Checking: This type of application control ensures that only the valid and
correct data is being processed (Kravets and Lapshina 2013).
iii) Identification: This type of application control ensures unique or irrefutable
identification of each and every user.
iv) Authorization: It ensures access to the application system by only authorized
users.
v) Authentication: It provides the mechanism of application system authentication.
vi) Input Controls: It ensures the data integrity within the application system from all
types of upstream sources (Van Der Aalst, La Rosa and Santoro 2016).
vii) Forensic Controls: It ensures the perfect data on the basis of inputs and outputs.

6
BUSINESS INFORMATION SYSTEM
5. Comparison of GMCs and ACs for Information System
The General Management Controls and the Application Controls are both utilized for
the information system.
The information technology General Management Controls are the policies as well as
the procedures, which relate to several applications and thus support the efficient
functionalities of the application controls by simply helping for ensuring the fact that the
proper operation of the information system is continued (Panetto and Cecil 2013). These
general management controls are applied to mainframe, end user environments and servers.
The GMCs mainly involve the controls over the data centre and the network operations,
acquisition of the system software, changing and maintenance, accessing of security,
acquisition of application system, development as well as maintenance (Whittington 2014).
The other IT general controls are the physical security of assets by including the adequate
safeguards like the secured facilities and the authorization of the access to data files and
computer programs.
The Application Controls of the Information Technology are those controls, which
could be related to the particular applications of computer software and all the individual
transactions (Arvidsson, Holmström and Lyytinen 2014). The key factors in the information
technology application controls are the identification, authorization, and authentication,
validity checking, input controls and checking of completeness.
These are different from GMCs as ACs is responsible controlling all the applications;
whereas GMCs are responsible for controlling overall management of the any particular
organization.

7
BUSINESS INFORMATION SYSTEM
6. Risk Management Techniques
a. Reliability, Confidentiality, Availability, Integrity and Security
The risk management techniques that are adopted by the organization of Telstra are
mainly responsible for ensuring the reliability, confidentiality, availability, integrity and
security.
Two such techniques are adopted by Telstra. They are as follows:
i) Avoidance: It is considered as the best method of controlling the losses (Laudon
and Laudon 2015). This is simply because the risk is avoided properly. It thus helps to
maintain the integrity of the organizational or business processes. The risks are avoided for
eliminating the threats.
ii) Loss Prevention: It is the technique by which loss is prevented and not eliminated.
This particular technique accepts the risk and attempts to reduce the loss. Security and
reliability are strictly maintained by this particular technique (Stair and Reynolds 2013).
b. Risk Identification, Risk Assessment and Risk Control
Risk identification, assessment and control are the most important three factors in any
organization. Telstra has adopted two distinct techniques for controlling their risks. They are
as follows:
i) Loss Reduction: The particular technique helps to reduce the loss that is incurred by
the risks in any organization (Venkatesh, Brown and Bala 2013). It only accepts the risk and
this helps to identify as well as assess and control the risk significantly.
ii) Separation: This technique involves several key assets. It ensures that if any type
of catastrophe occurs in a business operation, the risk would be easily controlled and
managed by the organization.

8
BUSINESS INFORMATION SYSTEM
7. Importance of Auditing Information System
Auditing can be defined as the survey that is being done by any organization to check
whether the systems of the company are being misused by the employees or not and also for
determining and identifying the culprits behind this (Galliers and Leidner 2014).
The information system of the Telstra organization is audited in every seven days for
checking the fact that whether the employees are misusing them or not. IS is responsible for
storing all types of confidential data or information and thus any type of vulnerability can
cause major loss to the company (Davies, Dean and Ball 2013). Moreover, it helps to
safeguard the data quality of the organization by an audit plan and process.
The audit plan of Telstra is given below:
i) Identifying the characteristic of Audit Engagement
ii) Defining Report Requirement
iii) Assessing the Conflict of Interest
iv) Risks Assessment
v) Accessing of necessary record and documents (Rainer et al. 2015).
The audit process of Telstra is given below:
i) Notifying the employees
ii) Discussing the scope and objectives
iii) Gathering information on vital processes
iv) Evaluating existing controls
v) Executing the plan.

9
BUSINESS INFORMATION SYSTEM
8. Conclusion and Recommendations
Therefore, from the above discussion it can be concluded that, information system can
be defined as the structured arrangement that is utilized for the collection, organization,
storage and also communication between information. It can also defined as the collection of
complementary networks, which all types of organizations and individuals utilize for the
proper filtering, collection, creation and distribution of data. IS or Information system is the
collection of several elements, that after interacting with one another produces accurate and
error free information or data. This type of information systems are used by all company in
the present days. Moreover, it makes the functions and services technology based. The above
report has outlined a detailed discussion on complete concept of IS or information systems’
services in any specific organization. Telstra Telecommunications Company is the selected
organization in this case. It is one of the most popular organizations in the sector of
telecommunications in Australia. This report has clearly depicted regarding the services of
information system and also the proper use of information system in Telstra. The various
GMCs or General Management Controls are well explained here. Moreover, the ACs or the
Application Controls that are being utilized by Telstra Company and the significant
comparison between ACs and GMCs are provided in the report. The several techniques of
risk management, which Telstra Company had solely adopted are also given here.
Furthermore, the report has also demonstrated the audit plan and processes of the selected
organization, Telstra.
It is highly recommended to Telstra to upgrade their information system for getting
more advantages and benefits from the system. The major objective of the information
system is to create all the functions and services of any organization, absolutely simpler and
smoother.

10
BUSINESS INFORMATION SYSTEM
9. References
Arvidsson, V., Holmström, J. and Lyytinen, K., 2014. Information systems use as strategy
practice: A multi-dimensional view of strategic information system implementation and
use. The Journal of Strategic Information Systems, 23(1), pp.45-61.
Cassidy, A., 2016. A practical guide to information systems strategic planning. CRC press.
Davies, R.S., Dean, D.L. and Ball, N., 2013. Flipping the classroom and instructional
technology integration in a college-level information systems spreadsheet
course. Educational Technology Research and Development, 61(4), pp.563-580.
Galliers, R.D. and Leidner, D.E. eds., 2014. Strategic information management: challenges
and strategies in managing information systems. Routledge.
Kravets, O.J. and Lapshina, M.L., 2013. Mathematical and program software for designing
intranet-interfaces during competitive development of information systems. American
Journal of Control Systems an Information Technology, (2), p.11.
Laudon, K.C. and Laudon, J.P., 2015. Management Information Systems: Managing the
Digital Firm Plus MyMISLab with Pearson eText--Access Card Package. Prentice Hall Press.
Panetto, H. and Cecil, J., 2013. Information systems for enterprise integration,
interoperability and networking: theory and applications.
Pearlson, K.E., Saunders, C.S. and Galletta, D.F., 2016. Managing and Using Information
Systems, Binder Ready Version: A Strategic Approach. John Wiley & Sons.
Petter, S., DeLone, W. and McLean, E.R., 2013. Information systems success: The quest for
the independent variables. Journal of Management Information Systems, 29(4), pp.7-62.

11
BUSINESS INFORMATION SYSTEM
Power, D.J., Sharda, R. and Burstein, F., 2015. Decision support systems. John Wiley &
Sons, Ltd.
Rainer, R.K., Cegielski, C.G., Splettstoesser-Hogeterp, I. and Sanchez-Rodriguez, C.,
2013. Introduction to information systems. John Wiley & Sons.
Stair, R. and Reynolds, G., 2013. Principles of information systems. Cengage Learning.
Telstra.com.au. (2018). Telstra - mobile phones, prepaid phones, broadband, internet, home
phones, business phones. [online] Available at: https://www.telstra.com.au/ [Accessed 31
Mar. 2018].
Van Der Aalst, W.M., La Rosa, M. and Santoro, F.M., 2016. Business process management.
Venkatesh, V., Brown, S.A. and Bala, H., 2013. Bridging the qualitative-quantitative divide:
Guidelines for conducting mixed methods research in information systems. MIS
quarterly, 37(1).
Whittington, R., 2014. Information systems strategy and strategy-as-practice: a joint
agenda. The Journal of Strategic Information Systems, 23(1), pp.87-91.