Corporate Governance & Social Responsibility Essay

Corporate Governance & Social Responsibility - Essay manakinBusiness organizations should not be interested only on the shargonholders (tutor2u, 2011, para.4). The employees as well as the social functionrs of these products need to be considered in the development of the operational strategies of the organization. The anguish addressed here should reflect on the type and quality of product offered to the consumers. While some products have no adverse effect on the companionable life of the users, others like alcoholic drink drinks and bhang are often associated with serious genial issues. Excessive drinking and drug abuse contribute significantly to other social issues like domestic violence, sexual abuse, or even manslaughter. Product advertisement After developing a product, a business company would always pauperization to let its product be known in the market. This is achieved through extensive promotion and advertisement of the product. The advertisements often appeal to the consumers on the benefits of the product. The contents of the advert allow for influence its effectiveness (Gunter, Oates, & Blades, 2005, p.123). The adverts explain why the product ranks well above the other products in the market and provide a direction on how to use the product (eHow, 2011, para.1). Largely, the advertisements have significant impacts on the usage of the products. Researches have shown that exposure to some advert increases the consumption of the advertised product (Gunter, Oates, & Blades, 2005, p.123). Ideally, this objective of advertisement (appealing to the universal to buy the product) should apply to those products not associated with social problems. However, for products that influence the society, especially the underage, the advertisements only need to be informative. The adverts should indicate prices of the product as well as where they could be obtained. For the alcoholic drinks in particular, the advertisements should stress on the targeted age group and emphasis that they should not be sold to underage. The associated health problems also need to be indicated in the adverts and containers of the products. Spykes and the company decision to stop its sales It is not appropriate to rule out that Spykes was a bad product. The company studied the market trend that had been enter in the past. Its development acme about after the company had observed that taste was moving from their traditional domestic brands like Budweiser (Case study, p.497). The product was not essential to attract underage drinkers as per the criticisms. Instead, it was targeting the drinkers in the age bracket of 21-30 (Case study, p.497). Besides, the product had caffeine additive to improve on its energy content. It also had lower alcohol content than the wine it had 12% alcohol content. The only mistake that the company did was that they did not emphasize on the age bracket that was targeted by the product. Even though the product was developed t o attract the young adults, its sweetest taste was criticized to attract the teenagers. It is assumed that alcoholic drinks with high-energy content are popular among the teenagers (Case study, p.498). The decorations at the website were also seen as appealing more to the teenagers than adults. After all the criticism that was launched on the product and its advertisement, the company did the right thing to withdraw the product. The so-called self-appointed civil activists are very significant influential in the market as

(Ethics and Communication) Illinois among states to settle with Article

(Ethics and Communication) Illinois among states to settle with GlaxoSmithKline - Article ExampleAlthough the two main ingredients Kytril and Bactroban were not fully contaminated, the tablets possessed not a full dose of an quick ingredient which did not satisfy the appropriate percentage of the substance listed in the bottle. Although the company denied of fraud, the head attorney confirmed that the accusation was legit and the attempt to earn taxation through illegal practices were exercised. Without a doubt, this article depicted the controversy related to a company who was charged of fraud because of varied content of substance in their capsules. Although the company has an excellent reputation for following compliances implemented by the government these type of instances should still be taken into account. Ethically speaking, the company should have make some attempt to at least inquire with the FDA to discuss the gravity of this situation. However, the company instead is de nying the charges that it made to benefit itself in the long-run. Clearly, this type of hostile billet does not only poses a risk for corporate ethics it also serves as a reminder of these type of scenarios can be detrimental to alliance itself. Corporations must make it their obligation to take responsibility in any sort of moral dilemmas so they lives of many can be saved.

Statement of qualification Essay Example | Topics and Well Written Essays - 500 words

Statement of qualification - Essay ExampleThese and other financial vicissitudes instilled a strong desire in me to learn and scan the intricate theories of finance and its workings.I carried these aspirations into my university studies where I chose to undertake a degree public life Economics. At every level, I strived to acquire the utmost possible insights active economy. I felt that taking Economics at the university level would gratify my pertains in financial matters and act as a stepping-stone to my dream career. The enriching experience I received in my undergraduate enthused me to dig deep on financial matters. The academically rigorous program and the milieu that was full of intellectually engaging course mates molded me a great deal. My performance in my undergraduate studies never slacked for a moment given that the environment and lectures gave ensured I stayed on slice academically. Often, I would wonder about the situation of the world economy. I also wanted to kn ow about the best stocks, interest rates, and bonds. These studies in economics furthered my interest in finance greatly. Studying economics has widened my interests in finance, and I aspire to know a lot on areas such as security analysis, valuation, and portfolio management. With time, I have also developed a keen interest in investments, and I am stimulated by the diverse valuation techniques involved in relative valuation and contingent claim.Taking numerous internship opportunities over summer periods and after graduation has done a lot in shaping my petulance in finance. The internships gave me an opportunity to have pragmatic experience in finance matters. The opportunities also opened up and deepened my interest in portfolio asset allocation and theory. This, couple with a Master in Finance from Santa Clara University, will give me further insight in valuation techniques and other finance matters in global markets. Mller and Achleitner (217) regard an in-depth knowledge in

Course Paper Assignment. You are required to write a 5-7 page paper on Term

Course Assignment. You are required to write a 5-7 page on a concept investigating the social effects of melodic phrase an - Term Paper ExampleIn fact, global tonne-kilometers (total weight of freight carried multiplied by the distance flown) increased by a factor of 23 as against the global domestic gross domestic product, which increase by a factor of 3.8 (Whitelegg, 2000). It is also forecast with unconstrained growth in the atmosphere industry, that childs play travel will double between 2000 and 2020 and triple in 2030 (Parliamentary Office of Science and Technology Postnote, 2003). Concurrently, there has been increase threat especially from the solid ground of terrorist on the aviation industry. This threat has direct to the implementation of the Transportation Security Administration (TSA) passenger screening to ensure that certain items and persons prohibited from flying do not board commercial airliners (Elias, 2011). This spectacular growth in the aviation industry is associated with some social effects which have either beneficial or adverse effects in the society. This growth in the aviation industry is mainly concentrated in certain societies in the world, for instance, North America, Europe, some split of Asia and South America (Zinnov LLC, 2007) thereby suggesting a cultural influence on the growth of the aviation industry. This article seeks to answer some questions associated with the growth of the aviation all over the decades. ... Discussion Social Effects of Air Travel Indeed, air travel has impacted socially on humanity, changing not only the human consanguinity but also human culture. Like the interstate highways that reduce continents to global cities, air travel has likewise shrunk the world to a global city. For instance, with the climax of air travel, the connectedness between slew increases considerably. Air travel makes it possible for people to connect easily with far away family members and friends. The business arena wa s also touch positively as business partners across continents can meet face-to-face to carry out business deals within days. Related to this connectedness between people is the improvement in communication. By the late 1930s, the airlines carried mail from coast to coast thereby improving the speed of communication and the connectedness between friends, family members and business partners (Hudson, 1972). Indeed, with the advent of the air travel, people became global citizens and can enjoy the excitements and cultures of societies other than theirs. Indeed, people can travel to far away resort centers for holidays. Air travel led to the growth of the tourist industry. Also affected is entertainment industry and arts. The enthrallment and allurement of air travel has been reflected in the literature. Many pilots have written slightly their careers. For instance, War World 1 hero, Eddie Rickenbacker wrote about their exploit during the World War 1 (Rickenbacker, 2001). Many childr en books feature famous military pilots as well as civilian pilots, and later astronauts. Related to literature are arts dealing with aviation. For instance, the Renaissance humanist, Leonardo da Vinci illustrated his notebooks with sketches of

An empirical evaluation of the Purchasing Power Parity Dissertation

An empirical evaluation of the Purchasing Power Parity - Dissertation ExampleIn involvement of investigating the empirical validity of the PPP theory, this study uses the monthly Nipponese Yen to US Dollar exchange rate and the seasonally adjusted Japanese and US monthly Consumer Price Index serial publication as the phonation of the price takes as available from OECD main economic indicators 2010. Our data set c overs a sample period ranging from 1st January1960 to 1st June 2010. The indexing of CPI for two the Japanese and US serial is in accordance with assuming the price level of 2005=100.5.EstimationThis section presents the results of the estimations specified in section 2. We start of by presenting the statistical preliminaries and time series plots of the variables to engender a preconception of what can be expect from the estimated equations. a.Statistical preliminariesTable 1 presents the summary statistics for the variables of interest. Note that these argon expresse d in terms of inherent logarithmarithms of the levels.Figure 1 below depicts the inter-temporal dynamics of the natural logarithm of the series of Japanese Yen to US Dollar Exchange rates. Observe that the series provides a clear visual evidence of a downward trend implying that over the period of 1970 to 2011, there has been a gradual decline in the exchange rate. Additionally, the series also appears to be non-stationary. Of course stationarity properties can only be once and for all verified after formal conduction of unit root tests. Figure 3 presents the time plots of Japanese and US consumer price indices in logs.... tion where is the natural log of the Japanese Yen to US Dollar exchange rate at time t, is the natural log of the price level index of Japan and is the natural log of the price level index of USA and is an additive iid noise term. 3. Testable Hypothesis The hypotheses that we can test using this specification are as follows i) square or absolute PPP ii) Relative ly weaker form of PPP ? iii) Weakest form of PPP ? Note that for ii) and iii) to be valid specifications, the additive error term go out have to be stationary. Otherwise estimates will be spurious. 4. Data In pursuit of investigating the empirical validity of the PPP theory, this study uses the monthly Japanese Yen to US Dollar exchange rate and the seasonally adjusted Japanese and US monthly Consumer Price Index series as the representative of the price levels as available from OECD main economic indicators 2010. Our data set covers a sample period ranging from 1st January1960 to 1st June 2010. The indexing of CPI for both the Japanese and US series is in accordance with assuming the price level of 2005=100. 5. Estimation This section presents the results of the estimations specified in section 2. We start of by presenting the statistical preliminaries and time series plots of the variables to engender a preconception of what can be expected from the estimated equations. a. Statis tical preliminaries Table 1 presents the summary statistics for the variables of interest. Note that these are expressed in terms of natural logarithms of the levels. Table 1 Summary Statistics of the variables of interest Figure 1 below depicts the inter-temporal dynamics of the natural logarithm of the series of Japanese Yen to US Dollar Exchange rates. Observe that the series provides a clear visual evidence of a downward trend

U.S. Department of Homeland Security's Role in Combatting Research Paper

U.S. subdivision of motherland Security&aposs Role in Combatting Cybersecurity - Research Paper ExampleWhile comparing the present cyber war towards the reactive US approach nations major wars i.e. WWII or war on Terror, considerable changes in the same can be apparently observed. One of such changes can be ascertained in secret service along with information operations. In this present day context, these particular aspects became quite modernized as compared to the earlier years due to rapid technological advancements (Geers 9-158).The cruciality of Cyber Security and DHSs National Role W/Obama Quote. On 12th February 2013, Obama passed an order to enhance the critical infrastructure of cyber security in the US. This order passed by Obama support in building, developing as well as maintaining public-private relationships with other partners and operators to create risk based cyber security system by sharing different information. concord to Obama, the role of cyber security and t he Department of Homeland Security (DHS) is to improve the infrastructure of the framework of cyber security by transferring the required information related to the protection of cyber threats and side by side(p) proper guidelines as well as rules (Waltzman, Giancarlo and Webb 1-4).This research paper intends to explain the responsibility of securing the nations and determine the infrastructure of cyberspace that can restrict in liner cyber threats or attacks on business and governmental policies. Apart from this, the research paper laid utmost focus on revealing the fact that the Department of Homeland Security must prioritize cybersecurity for ensuring the integrity of different nations, civilian and government networks as per the desired level. The research paper also deals with assessing the roles played by the Department of Homeland Security in the domain of cybersecurity. To address the above discussed aspects, the following objectives need to be attainedComparison of Intern al to External Threats (Government Accountability piazza

An analysis of Information Security Governance in the Universities in Zimbabwe Essay Example for Free

An analysis of cultivation auspices authorities in the Universities in Zimbabwe EssayAbstractThe complexity and diminutiveity of data gage and its governance demand that it be elevated to the highest organisational levels. Within a university setup, entropy assets include student and personnel records, wellness and financial randomness, research data, teaching and learning poppycocks and altogether restricted and unrestricted electronic library materials. pledge of these training assets is among the highest priorities in terms of happen and liabilities, concern continuity, and protection of university reputations.As a faultfinding resource, entropy essential(prenominal) be treated like any other asset essential to the survival and succeeder of the organization. In this paper the writer is going to discuss the bespeak for downing entropy Security Governance within institutions of higher education.Further than that, a discussion on how to best practice in fo Security governance within the universities in Zimbabwe followed by an sound judgement on how far the Zimbabwean universities have implemented nurture Security Governance. A combination of questionnaires and interviews is going to be used as a tool to gather data and some recomm polish offations argon stated towards the end of the paper. IntroductionGovernance, as defined by the IT Governance instal (2003), is the set of responsibilities and practices drilld by the board and executive direction with the goal of providing strategic direction, ensuring that objectives atomic number 18 achieved, ascertaining that dangers argon managed appropriately and verifying that the enterprises resources are used responsibly. Information pledge governance is the system by which an organization directs and controls info certificate (adapted from ISO 38500).It specifies the responsibility framework and provides oversight to chink that happens are adequately mitigated as well as ensuri ng that protective cover strategies are aligned with business and consistent with regulations. To exercise effective enterprise and information security governance, boards and senior executives must have a clear understanding of what to expect from their enterprises information security syllabusme.They need to know how to directthe implementation of an information security programme, how to appreciate their own status with regard to an existing security programme and how to decide the dodging and objectives of an effective security programme (IT Governance Institute, 2006). Stakeholders are becoming more and more concerned ab pop out the information security as mods of hacking, data theft and other attacks happen more frequently than ever dreamt of.Executive management has been showered with the responsibility of ensuring an organization provides exploiters with secure information systems environment. Information security is not only a technical issue, but a business and gover nance ch every last(predicate)enge that involves adequate risk management, reporting and accountability. Effective security requires the active sake of executives to assess emerging threats and the organizations response to them (Corporate Governance Task Force, 2004).Furthermore the organizations need to protect themselves against the risks inherent in the use of information systems plot of land simultaneously recognizing the benefits that can accrue from having secure information systems. Peter Drucker (1993) stated The diffusion of technology and the commodification of information transforms the role of information into a resource extend to in importance to the tradition on the wholey important resources of land, labor and capital.Thus as dependence on information system increases, the criticality of information security brings with it the need for effective information security governance. Need for Information Security Governance within universities. A severalize goal of inf ormation security is to reduce contrary impacts on the organization to an acceptable level of risk. Information security protects information assets against the risk of loss, operational discontinuity, misuse, unauthorized disclosure, inaccessibility and damage.It also protects against the ever-increasing electromotive force for civil or judicial liability that organizations face as a result of information inaccuracy and loss, or the absence of due care in its protection. Information security covers all information processes, strong-arm and electronic, regardless whether they involve people and technology or relationships with trading partners, customers and third parties. Information security addresses information protection, hole-and-corner(a)ity, availability and integrity passim the life cycle of the information and its use within the organization.John P. Pironti (2006) suggested that among many reasons for information securitygovernance, the most important one is the one concerned with the legal liability, protection of the organizations reputation and regulatory compliance. With the university setup, all members of the university community are obligated to respect and, in many cases, to protect confidential data. medical records, student records, certain employment-related records, library use records, attorney-client communications, and certain research and other intellectual property-related records are, subject to limited exceptions, confidential as a matter of law. umpteen other categories of records, including faculty and other personnel records, and records relating to the universitys business and finances are, as a matter of university indemnity, treated as confidential. Systems (hardware and software) designed primarily to inject confidential records (such as the Financial Information System and Student Information System and all medical records systems) require enhanced security protections and are controlled (strategic) systems to which access is fast monitored. Networks provide connection to records, information, and other networks and also require security protections.The use of university information technology assets in other than a manner and for the purpose of which they were intend represents a misallocation of resources and, possibly, a violation of law. To achieve all this in todays complex, interconnected world, information security must be addressed at the highest levels of the organization, not regarded as a technical specialty relegated to the IT part. Information security is a top-down process requiring a comprehensive security dodging that is explicitly linked to the organizations business processes and strategy.Security must address entire organizations processes, both physical and technical, from end to end. Hence, Information security governance requires senior management commitment, a security- aware culture, promotion of good security practices and compliance with policy. It is easier to buy a solution than to change a culture, but level the most secure system allow not achieve a significant degree of security if used by ill-informed, untrained, careless or unbiassed personnel (IT Governance Institute, 2006).In an interview the executive director and information security expert on IT Governance and cyber security with the IT Governance and Cyber Security Institute of sub-Saharan Africa, Dr Richard Gwashy Young has this to say remember inZimbabwe security is regarded as an expense not an investment (Rutsito, 2012). Benefits of Information Security GovernanceGood information security governance generates significant benefits, including The Board of directors taking full responsibility for Information security initiatives Increased predictability and reduced uncertainty of business operations by lowering information security-related risks to definable and acceptable levels Protection from the increasing potential for civil or legal liability as a result of information inaccuracy or the absence of due care.The structure and framework to optimize allocation of limited security resources sureness of effective information security policy and policy compliance A firm foundation for efficient and effective risk management, process improvement, and rapid incident response related to securing information A level of assurance that critical decisions are not found on faulty information Accountability for safeguarding information during critical business activities.Compliances with local and international regulations will be easier Improved resource management, optimizing knowledge, information security and information technology infrastructure The benefits add significant value to the organization byImproving swear in customer/client relationshipsProtecting the organizations reputationDecreasing likelihood of violations of privacyProviding greater confidence when interacting with trading partners Enabling raw and better ways to process electronic trans actions like publishing results online and online registration.Reducing operational costs by providing predictable outcomesmitigating risk factors that may delay the process The benefits of good information security are not just a reduction in risk or a reduction in the impact should something go wrong. Good security can improve reputation, confidence and trust from others with whom business is conducted, and can even improve efficiency by avoiding boney time and effort recovering from a security incident (IT Governance Institute, 2004). Information Security Governance OutcomesFive basic outcomes can be evaluate to result from developing an effectivegovernance approach to information security Strategic alignment of information security with institutional objectives Reduction of risk and potential business impacts to an acceptable level Value delivery through the optimization of security investments with institutional objectives Efficient utilization of security investments swani ng organization objectives death penalty measurement and monitoring to ensure that objectives are metBest practicesThe National Association of Corporate Directors (2001), recognizes the importance of information security and recommends four essential practices for boards of directors. The four practices, which are based on the practicalities of how boards operate, are Place information security on the boards agenda.Identify information security leaders, hold them accountable and ensure support for them. Ensure the effectiveness of the corporations information security policy through review and approval. Assign information security to a key committee and ensure adequate support for that committee. It is critical that management ensure that adequate resources are allocated to support the overall enterprise information security strategy (IT Governance Institute, 2006).To achieve effective information security governance, management must establish and maintain a framework to guide the development and maintenance of a comprehensive information security programme. According to Horton, et al (2000), an information security governance framework generally consists of An information security risk management methodologyA comprehensive security strategy explicitly linked with business and IT objectives An effective security organizational structureA security strategy that duologue about the value of information both protect and delivered Security policies that address each aspect of strategy, control and regulation A complete set of security standards for each policy to ensure that procedures and guidelines comply with policy Institutionalized monitoring processes to ensure compliance and provide feedback on effectiveness and mitigation of risk A process to ensurecontinued evaluation and update of security policies, standards, procedures and risks.This kind of framework, in turn, provides the tooshie for the development of a cost-effective information security progra m me that supports an organizations goals and provides an acceptable level of predictability for operations by limiting the impacts of adverse events. In his article Kaitano (2010), pointed some characteristics of good corporate governance coupled with good security governance.These include and not limited to Information security being treated as and organization wide issue and leaders are accountable. Leads to viable Governance, Risk and Compliance(GRC) Milestones It is risk-based and focuses on all aspects of securityProper frameworks and programs have been implementedIt is not treated as a cost but a way of doing businessRoles, responsibilities and segregation of duties are defined It is addressed and enforced by policyAdequate resources are committed and Staff are aware and trained It is planned, managed, measurable and measuredIt is reviewed and auditedThe overall objective of the programme is to provide assurance that information assets are protected in accordance with their v alue or the risk their compromise poses to an organization. The framework generates a set of activities that supports fulfillment of this objective. Principles for information security within the UniversityIn their article titled Information Security polity Best Practice Document, Hostland et al (2010) pointed out some guiding principles for information security within a university setup. The following are some of the principles they mentioned 1. Risk assessment and managementThe universitys approach to security should be based on risk assessments and should be continuously done and the need for protective measures evaluated. Measures must be evaluated based on the universitys role as an establishment for education and research and with regards to efficiency, cost and practical feasibility. An overall risk assessment of theinformation systems should be performed annually. Risk assessments must identify, quantify and prioritize the risks according to germane(predicate) criteria for acceptable risks.Risk assessments should be carried out when implementing changes impacting information security. Some recognized methods of assessing risks like ISO/IEC 27005 should be employed. Risk management is to be carried out according to criteria approved by the management at University. Risk assessments must be approved by the management and if a risk assessment reveals unacceptable risks, measures must be implemented to reduce the risk to an acceptable level. 2. Information security policyThe Vice Chancellor should ensure that the information security policy, as well as guidelines and standards, are utilized and acted upon. He must also ensure the availability of sufficient training and information material for all users, in order to enable the users to protect the universitys data and information systems.The security policy should be reviewed and updated annually or when necessary, in accordance with principles depict in ISO/IEC 27001. However, all important changes to universitys activities, and other external changes related to the threat level, should result in a revision of the policy and the guidelines relevant to the information security. 3. Security organizationThe Vice Chancellor is responsible for all government contact. The university should appoint CSO (Chief Security Officer). Each department and section should also be responsible for implementing the units information security. The managers of each unit must appoint recrudesce security administrators. The recording equipment Academics has the primary responsibility for the information security in connection with the student registry and other student related information.The IT Director has executive responsibility for information security in connection with IT systems and infrastructure. The Operations manager has executive responsibility for information security in connection with structural infrastructure. He also has overall responsibility for quality work, while the operational responsibility is delegated according to the management structure.The Registrar Human Resources also has executive responsibility for information security according to the Personal Data Act and is the controller on a daily basis of the personal information of theemployees. The Registrar Academics and Research Administration have also executive responsibility for research related personal information. Universitys information security should be revised on a regular basis, through internal control and at need, with assistance from an external IT auditor. 4. Information security in connection with users of Universitys operate Prior to employment security responsibility and roles for employees and contractors should be described.A background check is should also be carried out of all appointees to positions at the university according to relevant laws and regulations. A confidentiality agreement should be signed by employees, contractors or others who may gain access to sensitive and/or internal information. IT regulations should be accepted for all employment contracts and for system access for third parties. During employment, the IT regulations for the universitys information security requirements should be in home plate and the users responsibility for complying with these regulations is to be emphasized.The IT regulations should be reviewed regularly with all users and with all new hires. All employees and third party users should receive adequate training and updating regarding the Information security policy and procedures. Breaches of the Information security policy and concomitant guidelines will normally result in sanctions. Universitys information, information systems and other assets should only be utilized for their intended purpose. Necessary private usage is permitted. Private IT equipment in the universitys infrastructure may only be connected where explicitly permitted. All other use must be approved in advance by the IT department.On exhalati on or change of employment, the responsibility for termination or change of employment should be intelligibly defined in a separate routine with relevant circulation forms. The universitys assets should be handed in at the conclusion of the need for the use of these assets. University should change or terminate access rights at termination or change of employment. A routine should be present for handling alumni relationships. Notification on employment termination or change should be carried out through the procedures defined in the personnel system. 5. Information security regarding physical conditionsIT equipment and information that require protection should be placed in secure physical areas. Secure areas should have suitable access control toensure that only authorized personnel have access. All of the Universitys buildings should be secured according to their classification by using adequate security systems, including suitable tracking/logging. Security managers for the vari ous areas of responsibility should ensure that work performed by third parties in secure zones is fitly monitored and documented.All external doors and windows must be closed and locked at the end of the work day. On securing equipment, IT equipment which is very essential for daily activities must be protected against environmental threats (fires, flooding, temperature variations). Information classified as sensitive must not be stored on portable computer equipment (e.g. laptops, cell phones, memory sticks). If it is necessary to store this information on portable equipment, the information must be password protected and encrypted in compliance with guidelines from the IT department.During travel, portable computer equipment should be treated as carry-on luggage. Fire drills should also be carried out on a regular basis. 6. IT communications and operations managementPurchase and installation of IT equipment and software for IT equipment must be approved by the IT department. The I T department should ensure documentation of the IT systems according to universitys standards. Changes in IT systems should only be implemented if well-founded from a business and security standpoint. The IT department should have emergency procedures in order to minimize the effect of unsuccessful changes to the IT systems.Operational procedures should be documented and the documentation must be updated following all substantial changes. Before a new IT system is put in production, plans and risk assessments should be in place to avoid errors. Additionally, routines for monitoring and managing unforeseen problems should be in place. Duties and responsibilities should be separated in a manner reducing the possibility of unauthorized or unforeseen abuse of the universitys assets.Development, testing and maintenance should be separated from operations in order to reduce the risk of unauthorized access or changes, and in order to reduce the risk of error conditions. On system planning and acceptance, the requirements for information security must be taken into consideration when designing, testing, implementing and upgrading IT systems, as well as during system changes. Routines must be actual forchange management and system development/maintenance.IT systems must be dimensioned according to capacity requirements and the load should be monitored in order to apply upgrades and adjustments in a timely manner as it is especially important for business-critical systems. Written guidelines for access control and passwords based on business and security requirements should be in place.Guidelines should be re-evaluated on a regular basis and should contain password requirements (frequency of change, minimum length, character types which may/must be utilized) and regulate password storage. All users accessing systems must be authenticated according to guidelines and should have unique combinations of usernames and passwords. Users are responsible for any usage of their usernames and passwords. Data GatheringA structured questionnaire adapted and modify from previous questionnaires used by Corporate Governance Task Force, (2004) was used as the main instrument to gather data. Of the total 13 universities in Zimbabwe, 9 managed to participate in this research. The questionnaires were completed by the Executive Dean, IT Director, Operations Manager or Chairperson for the department. Section I brass instrumental Reliance on ITThe get-go section was designed to help in determining the institutions reliance on information technology for business continuity. Table 1 Characteristics of OrganizationQuestionsScores/Frequency01234Dependence on information technology systems and the Internet to conduct academic, research, and outreach programs and offer support services9Value of organizations intellectual property stored or transmitted inelectronic form27The esthesia of stakeholders (including but not limited to students, faculty, staff, alumni, governing boards, legislators, donors, and funding agencies) to privacy234Level of regulation regarding security (international, federal, state, or local regulations) 1431Does your organization have academic or research programs in a sensitive area that may make you a target of violent physical or cyber attack from any groups?5121 chalk up score196722 make headway Very Low = 0 Low = 1 Medium = 2 High = 3 Very High = 4 Section II Risk ManagementThis section assesses the risk management process as it relates to creating an information security strategy and program. Table 2 Information SecurityRisk AssessmentQuestionsScores/Frequency01234Does your organization have a documented information security program?252Has your organization conducted a risk assessment to identify the key objectives that need to be supported by your information security program?243Has your organization identified critical assets and the functions that rely on them?225 energise the information security threats and vulnerab ilities associated with each of the critical assets and functions been identified?2421Has a cost been assigned to the loss of each critical asset or function?1332Do you have a written information security strategy?2421Does your written information security strategy include plans that seek to cost-effectively reduce the risks to an acceptable level, with minimal disruptions to operations? 4221Is the strategy reviewed and updated at least annually or more frequently when significant changes require it? 2331Do you have a process in place to monitor federal, state, or international legislation or regulations and determine their applicability to your organization? 22321Total1016261416Scoring Not Implemented = 0 plan Stages = 1 Partially Implemented = 2 crocked to Completion = 3 Fully Implemented = 4 Section III PeopleThis section assesses the organizational aspects of the information security program. Table 3 Information Security Function/OrganizationQuestionsScores/Frequency01234Do yo u have a person that has information security as his primary duty, with responsibility for maintaining the security program and ensuring compliance? 4311Do the leaders and staff of your information security organization have the necessary experience and qualifications? 522Is responsibility distinctly assigned for all areas of the information security architecture, compliance, processes and audits? 3411Do you have an ongoing training program in place to build skills and competencies for information security for members of the information security function? 2232Does the information security function report regularly to institutional leaders and the governing board on the compliance of the institution to and the effectiveness of the information security program and policies? 2331Are the senior officers of the institution ultimately responsible and accountable for the information security program, including approval of information security policies?342Total16171470Scoring Not Implement ed = 0 Planning Stages = 1 Partially Implemented = 2 Close to Completion = 3 Fully Implemented = 4 Section IV ProcessesThis section assesses the processes that should be part of an information security program. Table IV Security Technology StrategyQuestionsScores/Frequency01234Have you instituted processes and procedures for involving the security personnel in evaluating and addressing any security impacts before the purchase or introduction of new systems? 2331Do you have a process to appropriately evaluate and classify the information and information assets that support the operations and assets under your control, to indicate the appropriate levels of information security? 12321Are written information security policies consistent, easy to understand, and readily available to administrators, faculty, employees, students, contractors, and partners? 2331Are consequences for noncompliance with corporate policies clearly communicated and enforced? 13231Do your security policies effect ively address the risks identified in your risk analysis/risk assessments? 234Are information security issues considered in all important decisions within the organization? 3231Do you constantly monitor in real time your networks, systems and applications for unauthorized access and anomalous behavior such as viruses, malicious code insertion, or break-in attempts? 13311Is sensitive data encrypted and associated encryption keys properly protected? 23211Do you have an authorization system that enforces time limits and defaults to minimum privileges?2223Do your systems and applications enforce session/user management practices including automatic timeouts, lock out on login failure, and revocation?2322Based on your information security risk management strategy, do you haveofficial written information security policies or procedures that address each of the following areas?Individual employee responsibilities for information security practices4311Acceptable use of computers, e-mail, In ternet, and intranet2322Protection of organizational assets, including intellectual property2232Access control, authentication, and authorization practices and requirements 12312Information sharing, including storing and transmitting institutional data on exterior resources (ISPs, external networks, contractors systems) 21321Disaster recovery contingency planning (business continuity planning)1134Change management processes2322Physical security and personnel clearances or background checks1332Data backups and secure off-site storage1134Secure disposal of data, old media, or printed materials that contains sensitive information234For your critical data centers, programming rooms, network operations centers, and other sensitive facilities or locations234Are four-fold physical security measures in place to restrict forced orunauthorized entry?1233Is there a process for issuing keys, codes, and/or cards that require proper authorization and background checks for access to these sensit ive facilities?2133Is your critical hardware and wiring protected from power loss, tampering, failure, and environmental threats?144Total1745585047Scoring Not Implemented = 0 Planning Stages = 1 Partially Implemented = 2 Close to Completion = 3 Fully Implemented = 4 interventionAs shown by the total scores on Table 1, a majority of the university has a very high reliance on the IT in their services. This is picture by the structure and characteristics of the university. Information risk assessment and management leaves a lot to be desired by the universities. to the highest degree the universities have partially implemented such programs.A large number of employees in the IT departments of most universities do no have sufficient skills to implement good information security governance. Most universities lack the leaders who have the rightful know how on the subject. In additionto that, there is no a representative in the council who will be an IT expert, hence most leaders lack i nterest and initiatives on information security.Due to lack of full responsibility of information security by the leaders, to implement processes for information security might also be a challenge especially to the IT department as normally is the department given the responsibility. Conclusion there is a need for institutions to start focusing on proper information security governance.For a start organization such as the Government, the Computer friendship of Zimbabwe, Zim Law Society, POTRAZ, ICAZ, IIAZ, Zimbabwe Institute of Management and other industry governing bodies should put their heads together and define the appropriate legislations that mandates information security governance either by referring to existing international frameworks (PCI-DSS, SOX, COSO, ITIL, SABSA, Cobit FIPS, NIST, ISO 27002/5, CMM, ITG Governance Framework) or by consulting local information security and business professionals to come up with an information security governance framework.As the Zimba bwean economy is slowly sprouting, the art of information security governance in the universities should also take a leap. The adoption information security governance will ensure that security will become a part of any university and thus customers confidence will be boosted.ReferencesDrucker, P. Management Challenges for the 21st light speed, Harpers Business , 1993. Corporate Governance Task Force, Information Security Governance Call to Action, USA, 2004. IT Governance Institute, Board Briefing on IT Governance, 2nd Edition, USA, 2003, www.itgi.org. IT Governance Institute, Information Security Governance Guidance for Boards of Directors and Executive Management, 2nd Edition, USA, 2006. ISO/IEC 38500 Corporate Governance of Information Technology, 2008. IT Governance Institute, COBIT 4.0, USA, 2005, www.itgi.orgIT Governance Institute, COBIT Security Baseline, USA, 2004, www.itgi.org National Association of Corporate Directors, Information Security Oversight Essential Board Pra ctices, USA, 2001 John P. Pironti,Information Security Governance Motivations, Benefits and Outcomes, Information Systems Control Journal, vol. 4 (2006) 458. 21. Rutsito, T. (2005) IT governance, security define new era The Herald, 07 November. Kaitano, F. (2010) Information Security Governance Missing Link In Corporate Governance TechZim. http//www.techzim.co.zw/2010/05/information-security-governance-missing-link-in-corporate-governance accessed 02 May 2013.Horton, T.R., Le Grand, C.H., Murray, W.H., Ozier, W.J. Parker, D.B. (2000). Information Security Management and Assurance A Call to Action for Corporate Governance. United States of America The Institute of Internal Auditors. Hostland, K, Enstad, A. P, Eilertsen, O, Boe, G. (2010). Information Security Policy Best Practice Document. Corporate Governance Task Force, (2004). Information Security Governance Call to Action, USA