Information System Control Selection Using Spreadsheet Optimization

Abstract

Today even the smallest organization depends heavily on information systems (IS) to support achievement of its objectives. Thus there exists a need for tools and techniques for choosing controls, or IS components that assure system dependability. Several researchers have developed quantitative models of controls. One such model for choosing controls incorporated the trade-off between the cost of establishing controls and the cost of not having them. The model was a refinement of the "control evaluation table" method used by auditors, enhanced with a probability model of control effectiveness, and formulated as a 0-1 nonlinear optimization problem. This paper presents a brief review of the model formulation and then goes on to provide a spreadsheet model solution.