POA Security Management Chapters 2,3,4,7,9 and 10 Flashcards
Reading from Domain #1
Report of the Nations: 2018 Global study on Occupational Fraud and Abuse, Published by the Association of certified Fraud examiners , divides Fraud into 3 categories that are:
Asset Misappropriation, corruption and financial statement fraud
Clark and Hollinger hypothesis the following are used to explain employee theft:
External economic pressure, youth and Work, Opportunity, job dissatisfaction, Social Control
Edward Sutherlands theory non-shareable needs theory states that
Criminal behavior is most often correlated with an individuals association with a criminal environment.
Donald Cressey’s theory defines the issue of theft/fraud as:
A violation of a position of financial trust, involves individuals having non-sharable financial problems. Theorizes that 3 elements are present prior to a crime occurring. elements are
The perception of a non-shareable problem, An opportunity for a trust violation, A series of rationalizations that allow the individual to justify their behavior as appropriate for the situation.
Response Strategy for dealing with insider threat of fraud incident includes:
Convening a quick reaction team, Creating a cross-divisional team to establish thee facts of the case, Investigating why the theft occurred, Conduct a root cause analysis, develop a remediation plan.
The following are a model for dealing with Theft and Fraud the elements of the cycle are:
- Prevention Programs
- Incident
- Incident reporting
- Investigation
- Action
- Resolution
- Analysis
- Publication
- Implementation of Controls
- Compliance Testing and Training
Steven Kirby and Edward Kirby share 50 Honest truths about employee theft, including:
No theft no matter how minor should be tolerated or ignored, No one gets caught the first time, Your so called 6th sense is usually pretty accurate so trust it, Virtually every theft or fraud could have been prevented by better management, Tenure is not an insurance against theft, An employees ethical makeup will temper the temptation to steal, Virtually all employees who steal have rationalized behavior, employees who know of unreported thefts are as bad a thief’s.
When dealing with Cost effectiveness of Security Programs the following should be taken into consideration
Design,
Installation,
Operation,
It Expenses,
Maintenance and
Replacement
Kovacich and Halibozek define Security metrics as:
The process of measuring an asset protection programs cost and benefits as well as its successes and failures.
When Security Professionals are presenting metrics to senior Management they should ensure:
-Present Metrics that meet standards
-Tell a story
-Use graphics and keep presentations short
-Present metrics data regularly
Promote Security Functions;
The 8 steps to writing a business case:
- Executive Summary
- Project description
3.Buisness Impact - Justification
5.Cost-Benifit Analysis - Alternatives and Analysis
- Recommendations
- Approvals
A investigation is
a process of logically, methodically and lawfully gathering information for the specific purpose of documenting information for the specific purpose of objectively developing a reasonable conclusion based on the facts learned through the process.
Corporate of organizational setting investigations generally fall into the following categories:
Documenting incidents
Identifying the cause of undesirable situations where nefarious activity is suspected
Documenting and correlating facts where nefarious activity is suspected
Documenting and correlation facts surrounding misconducted or inappropriate behaviors
Identifying, interviewing or surveilling suspects involved in a crime or misconduct
Compilling informations that proves or disproves an allegation
Allowing a decision to be made regarding an individual or an organization
Preforming threat assessments to help prevent work place, internal or third party violence
Collecting crime data and other material to help mitigate liability and risks to the enterprise.
Managing investigations entails basic functions of management which are:
planning
organizing
directing
coordinating
controlling
Levels of investigation management are:
Strategic level - high level management involved, legal council
Operational level Technical aspects, how function works within the department
Case level Involves individual investigations investigation techniques and case management protocols.
Investigative Process 4 phases:
- Initiation
2.Investigation - Report findings retain information
- Final phase addressed the use of the results for statistical analysis , program evaluation, strategic planning, budgetary forecasting (and more)
Legal considerations of investigations include the following:
Compliance with laws (Private investigations licensing conduct of investigators)
Compliance with regulatory reporting requirements in applicable jurisdictions
The possibility of civil suite based on allegations of defamation, false imprisonment, false arrest, retaliations and harassment
The possibility of subpoenas to testify produce written records of investigation or both
Step of choosing a security consultant:
- Identify candidates
2.Invite candidates to submit application
3.Evacuate applications - Interview the top 2 or 3 candidates
- Negotiate an agreement and finalize the selection
EP Program Management involves:
Threat assessment
Vulnerably assessment
risk assessment
Operations
In Asset Protection new paradigm shifts have included changes in:
-Changes in Surveillance Technology
-integrated Security Systems
-The scope of Security Professionals Duties
-legal and liability issues
-The regulatory environment
-the use of computers in the security function
-public/private partnerships
antiterrorism
-Convergence
-Global Business relationships
In short Asset Protection should involve:
a comprehensive strategy, not just piecemeal elements
The 4 ways to manage risk and the 4 D’s are:
Risk Management:
Eliminate, Reduce, Transfer, Accept
The 4 D’s of asset Protection:
Deter, Deny, Detect, Delay
IAP (Information Asset Protection) is also known as:
Information Security
