Write short notes on the following: Steering Committee for Security in Audit of Management Control.

Steering Committee for Security in Audit of Management Control The formulation and implementation of a sound security policy should not be the task of the IT Department only. It should be a team effort, brought into effect by a committee in which there is at least one member of the Board of Directors apart from the Chief Information Officer and User HoDs. It is to be noted that the auditor should point out the absence of such a committee in case any organisation does not have it. Without such a committee having regular planned meetings with agenda and action points, the implementation of security policy would be in jeopardy. The auditor needs to stress upon the possible benefits of a properly functioning steering committee or conversely, the ill effects of not having such a committee. In recommending the constitution and functioning of the committee, the auditor should be specific about composition, individual roles and responsibilities and monitoring/ escalating mechanism.