Suggest what should the management team NOT do when identifying excessive controls?
The CIO of a large multinational organization has received complaints that work is slowing down as staff is often overwhelmed when trying to comply with controls. This is creating unintended and undesirable effects in other parts of the organization. In response, the CIO has asked their management team to ensure that the existing controls are sufficient, but not excessive. What should the management team NOT do when identifying excessive controls?
OPTIONS
- Work across multiple stakeholder groups to identify what data is useful for the organization
- Increase the amount of data measured and reported on because the data might be needed in the future
- Determine if the staff is using placeholder data to complete mandatory fields so they can continue to work if the required data is not available
- Review external drivers, particularly legal obligations that impact the way the organization works
ANSWER
Increase the amount of data measured and reported on because the data might be needed in the future
EXPLANATION
It is impractical, however, to measure everything. Measurements should be limited to those that can be actively used to make informed decisions. The management team should avoid doing so, and use the guiding principle focus on value to identify the data needed to make better decisions.
