Information & Communication Technology
Information & Communication Technology
Leveraging ICT in Corporate Governance - the Australian Experience
Marghanita da Cruz, Principal Consultant, Ramin Communications
Forging Leadership & Sustainability
in the Global Environment
Malaysian Corporate Governance Conference
Securities Commission, Kuala Lumpur 15/16 May 2008
Approach
- Why the Interest in Corporate Governance
- Regulation & Legislation
- Financial
- Information and Communications Technology Related
- Need for Governance of ICT within organisations
- Standards and Guides
Why the Interest in Corporate Governance
- Failure of Australian Listed Companies
- HIH (Insurer)
- Ansett (Airline)
- One.Tel (Mobile Telephony)
- Fall out from US (dotcom bubble, Enron)
- Compulsory Superannuation
Financial Regulation and Legislation
- Goods and Services Tax Business Activity Statement (2000)
- Sarbanes Oxley (US - 2002)
- CLERP 9 Corporate Reporting & Disclosure (2004)
- Company Reports to be provided on websites (2007)
- Australian Legal Information (www.austlii.edu.au)
ICT Compliance Requirements
- Commonwealth Criminal Code 1995 -Computer Offences
- Telecommunications 1997 (Interception 2006)
- Broadcasting Services 1992 (Amendments: Online Services 1999, Digital broadcasting & Datacasting 2000)
- Information Privacy 2000
- Copyright (Amendments in 2004 for US-Aus FTA)
- Do Not Call Register 2006
- SPAM 2003
- Disability Discrimination 1992 (Accessibility of Websites)
- Net Alert - content filtering
Privacy Act 1988 Personal Information Principles
- Manner and purpose of collection
- Solicitation from individual concerned and generally
- Storage and security
- Information relating to records kept by record-keeper
- Access to records
- Alteration of records
- Record-keeper to check accuracy etc before use
- Limits on Use and disclosure
ICT and Corporate Performance
- Not a Risk free Investment
- Cisco, Microsoft, Google...
- Worldcom and One.Tel
- IT Project failures
- Pros and Cons
- Fraud vs Efficient Business Operations
- Information Access vs Leakage
- Misuse of Organisations Resources
- Online auction & shopping scams
- Fake Domain name renewals
- Spam (junk mail) offers
- Modem jacking & Spyware
- Phishing & Card Skimming
Experience of Online Credit Card Fraud (aic.gov.au)
Table 3: Number and percent of victims of online credit card fraud by business type in Australia |
| | Currently trading online | Previously traded online |
| Business type | n | % victims | n | % victims |
| Florists | 296 | 28 | 24 | 0 |
| Book sellers | 181 | 43 | 15 | 33 |
| Recorded music retailers | 77 | 26 | 15 | 17 |
| Toy and game retailers | 72 | 33 | 9 | 100 |
| Computer hardware retailers | 215 | 30 | 32 | 50 |
| Total | 841 | 32 | 95 | 34 |
| Source: Australian Institute of Criminology, Online credit card fraud against small business 2003 [computer file, weighted data] |
IT Pressures and Needs
- Open Source
- Internet/Web Based
- Integration of Business Systems across organisations
- Flexibility - Mobility - Globalisation of Employment
- Sourcing Models
Standards & Guidelines
Australian Corporate Governance Standards(2004)
- Good Governance Principles
- Fraud and Corruption Control
- Organisational Codes of Conduct
- Corporate Social Responsibility
- Whistle Blower protection programs
- Risk Management (AS3806/4360)
- Corporate Governance of ICT (AS8015-2005)
ASX Principles & Best Practice (2003, 2007)
AS8015 Principles
- Establish Responsibilities
- Plan ICT
- Acquire ICT validly
- Ensure that ICT performs
- Ensure ICT conforms
- Ensure ICT respects human factors
AS8015 Model
- Evaluate against Pressure & Needs
- Direct Policies & Plans
- Monitor Conformance and Performance
Other Standards & Better Practice Guidelines
- OECD Security Principles
- Record Keeping (ISO 15489)
- Information Security (ISO27001)
- Service Management (ISO20000)
- Interchange of Client Information (AS 4590)
- Environmental Impact (ISO14000,Energy Ratings)
OECD Security of Information Systems and Networks Principles
- Awareness
- Responsibility
- Response
- Ethics
- Democracy
- Risk Assessment
- Security design and implementation
- Security Management
- Reassessment
Summary & Discussion
- Regulations & Legislation require organisations to use ICT
- ICT introduces real threats so, Government and other Organisations need to be prudent in their use and investment in ICT
- Wide range of Standards & Guidance available
- ramin.com.au/itgovernance
References & Further Reading
