George Spafford

The pendulum has swung from too few controls towards too many controls in organizations rushing to meet various regulatory guidelines. Along the same lines, some control designs have shifted from simple towards being excessively complex. These movements are being driven by a lack of understanding of internal control requirements and a large dose of fear […]

Underlying all of IT’s fancy servers, networking gear and other devices is the need for clean, reliable power. This basic foundation is often taken for granted and not sufficiently reviewed. As a result, IT may be forced to deal with excessive amounts of equipment failure, corrupted data and overall service-level issues. This topic will be […]

Have you ever noticed that some of the most respected IT people in a company are those that just dive into problems and fix them? These people repeatedly wade in, save the users, get a ton of accolades and everyone is happy. We term these people “firefighters” because they constantly move from one unplanned “fire,” […]

A tremendous number of articles have been written about ISO 17799, ITIL and COBIT. Unfortunately, a number of these articles inaccurately identify these three bodies as control frameworks, and I am repeatedly encountering IT people who are confused about this. Let’s take a moment to reset perspectives, both about controls and which of these three […]

I was buying some clothes at a major department store the other day and was struck by the extra effort the clerk was putting in — simply because of a lack of standards. And if it was causing a problem in this store, imagine what it would do in your IT department. The problem arose […]

As many domestic firms scramble to meet the year-end deadline for Sarbanes-Oxley (SOx) section 404 compliance and foreign firms eye their deadline next year, they are hiring a ton of consultants to help them put the necessary control environments in place. While this type of decision-making is understandable, it does carry some risks due to […]

Wile many businesses and IT enterprises these days are placing increased emphasis on policies and procedures, few are looking at why their policies and procedures are so routinely bypassed. Certainly, perceptions of practitioners play a large role, but so too does the tone from the top and pressures placed on the organization. If groups fail […]

How often have you reviewed an incident and asked, ”How could they fail to see the cause of the error before it became such a huge problem?” Certainly there are benefits to reviewing a negative event, or series of events, and determining how to prevent them. During the review process, what must be avoided is […]

Due to pressures for regulatory compliance, such as Sarbanes-Oxley section 404, plus needs for overall process improvement, there is a distinct push for controls in IT. Unfortunately, IT personnel in general are not versed in basic control theory. This article will briefly cover some basic concepts surrounding controls. Essentially, think of a control as a […]

There was much talk in the 1990’s about the convergence of video, audio and data. And what we have today certainly is proving the validity of that vision. Video and audio, or course, can be digitized and treated as data. To put it another way, on our networks and computers today, video and audio are […]