Question

Risks and Controls

A. Tom works at a Fitness studio as a receptionist. His role is to verify that everyone who comes in is a member or pays a fee to come into the gym. He really needs to go to the toilet so he leaves the reception unattended and runs to the toilet.

B. Jill is the CFO of a company. She normally takes public transport and every day she works at home using her office laptop. On her way home she forgot her laptop in the bus.

C. Mike is a courteous employee of a financial company. The financial company has card readers at every door to make sure that only authorized personnel is able to access the building. Mike holds the door open for other people who are trying to get into the building.

Write down 5 examples of risks?
• How would you mitigate (limit) this risk?
• What type of control is this (preventive, detective or corrective)?

Answer 1

Five examples of risks that could arise from the above scenarios are:

1. Risk of unauthorised entry into the Fitness Studio
2. Risk of loss of revenue due to unauthories entry into the Fitness Studio
3. Risk of loss or theft of sensitive company data due to loss of laptop by Jill
4. Risk of unauthorised personnel into the company due to Mike permitting entry since Mike might not be aware of each and every person who is employed
5. Risk of tailgating and risk of unauthorised personnel accessing sensitive data, theft of personal belongings in case Mike is not aware of who was let inside the company

A. To mitigate the risks of unauthorised entry into the Fitness Studio, the following measures can be considered:

• Have another employee of the Fitness Studio relieve the Receptionist on a regular basis (Preventive control)
• Install access based entry systems like access cards or biometric entry (Preventive control)
• Install CCTVs to monitor (Detective control)

B. To mitigate the risk on loss of laptop, following can be considered:

• Encrypting laptops with strong password protection (Preventive control)
• Filing of police compliant with transport department to try and locate the laptop (Corrective control)
• Installation of tracking devices to locate the laptop (Detective control)
• Installaton of security software to enable remote deletion of all data stored in the laptop (Preventive control)

C. To mitigate the risk of unauthorised entry into the Financial Company, the following can be considered:

• Installation of CCTVs to monitor entry and exit of people (Detective control)
• Deploying security personnel to ensure no tailgating (Preventive control)
• Making it mandatory for employees to wear employee ID cards to ensure unauthorised personnel don't gain access (Detective control)
• Issuing instructions to employees against allowing other personnel to enter the building and imposing stiff penalties (Corrective control)