An online retailing company is concerned about new regulations requiring that customer data be securely kept and only released to third parties with permission from the customer. If it fails to do this, it will incur severe fines and penalties which may bankrupt the firm.

Currently, the only control the company has is a written procedure requiring staff not to disclose information. Testing shows it is followed 90% of the time, which is considered as low as can be achieved with this type of control that relies solely on correct human action.

Answer the following:

1. Describe whether, in your opinion, the control is critical and whether it is effective.

2. Describe human factor risk and give at least one reason why the current control may fail.

3. What changes do you recommend that could improve control effectiveness?