AAA Inc., a pharmaceutical firm, provides discounted prescription drugs through direct mail.

AAA has a small systems staff that designs and writes AAAs customized software. With the addition of a small staff of systems developers and software technicians, AAA has decided to maintain an in-house data processing function, rather than outsource it to a service bureau.

AAA has experienced significant sales growth due to the increased prices of prescription drugs. Medical insurance companies have been restricting reimbursements to minimize increases in premiums. AAA has purchased its own computer hardware because of its growth. The computer center is located on the ground floor of its two-story headquarters building. The large plate-glass window allows people entering the building to observe the activity in the computer center. Because the computer center often gets hot in the afternoons when the sun shines through the window, the door is sometimes left propped open while the computer center employees are working (it is always closed when no one is in the computer center). The computer area is equipped with halon gas fire suppression equipment, restricted access requiring a 4-digit code for entry (which is assigned to the employee based on their birth date), and an uninterruptible power supply system.

AAA has hired a small computer operations staff to operate this computer center. To handle AAAs current level of business, the operations staff is on a three-shift schedule (eight hours each), five days per week. Because there is little activity during the graveyard shift from midnight to 8 a.m., there is no supervisor in the computer center during that time, although the day supervisors rotate being on call if needed. AAAs systems and programming staff, now located in the same building, have access to the computer center and can test new programs and make program changes when the operations staff is not available. As the systems and programming staff is small and the work demands have rapidly increased, systems and programming documentation is developed only when time is available.

Periodically, but not on a scheduled basis, AAA backs up its programs and data files, storing them at an off-site location two blocks from the main office. Unfortunately, due to a tropical depression dumping 48 inches of rain in two days, AAAs building recently experienced severe flooding of three feet into the first floor, affecting not only the computer hardware, but also the data and program files that were on site. The plate glass window cracked, keeping the air conditioning system from cooling the center properly. In addition, the back-up files at the off-site location were destroyed.

Questions

1. Describe at least three internal control weaknesses related to computer security that existed at AAA Inc. prior to the flood occurrence.
2. Describe at least three components that should be incorporated in a formal disaster recovery plan in order that AAA Inc. can become operational within 72 hours after a disaster affects its computer operations capability.
3. What recommendations would you make to AAA to improve security and facility controls?