Category Archives: Internal controls

Can you censor?

“China Censors Spark Uproar In Quashing Student Activist,” The Wall Street Journal, April 25, 2018 A7.  Students make a request for open records from the Peking University about 20-year old rape allegations. The government rejects it. And then slams a student who circulated a letter telling her story through social media.  And that story circulates.

It sure is hard to put the genie back in the bottle after information gets to the Internet.  Are your controls adequate?  How do you enforce them?  Even if you have a command and control culture?

Advertisements

Leave a comment

Filed under Access, Compliance, Controls, Duty, Governance, Government, Interconnections, Internal controls, IT, Oversight, Third parties, Who is in charge?

Administrative procedures

“EPA Limits Data Used in New Rules,” The Wall Street Journal April 25, 2018 A4. Underlying studies must be made public and the findings must be reproducible before research will be used to justify new regulations.

Does the government need to allow you an opportunity to contest the “facts” upon which regulations are issued?  Is it right for the US government to rely upon scientific studies that in turn rely on secret information in order to establish regulations?  Do the government need to independently validate information before taking regulatory action?   How can an opponent reasonably contest the wording and scope of a regulation if he/she can’t see the evidence?  Or if the evidence doesn’t prove what the scientist says it proves?

Is this about information, or governance, or information governance?  More than one?

Leave a comment

Filed under Access, Accuracy, Controls, Data quality, Duty, Duty of Care, Governance, Government, Internal controls, Oversight, Third parties

Early warning

“SunTrust Sees Risk of Breach,” The Wall Street Journal, April 21, 2018 B3.  A SunTrust employee may have stolen information (names, addresses, account balances, and phone numbers) on 1.5 million customers.

The bank became aware of a problem in February, but only recently became aware that the (now-former) employee was trying to share the information outside the bank.

Good for the bank to have systems that notice the unusual activity and for the bank to have given relatively early notice.

 

Leave a comment

Filed under Communications, Controls, Corporation, Duty, Employees, Governance, Internal controls, Oversight, Privacy, Protect assets, To report

Phone companies can’t conspire, can they?

“Probe Focuses on Cellphone IDs,” The Wall Street Journal, April 21, 2018 B1.  DOJ investigates.

Are phone companies (and a standard-setting company) conspiring to make it harder for you to keep your phone number if you change carriers?  Or are they trying to make phones smaller?

Is your phone number information?  If so, to whom does it belong?  Is this just about whether you have to remove the SIM card to change carriers?

Just asking.

Leave a comment

Filed under Information, Ownership, Definition, Interconnections, Controls, Internal controls, Access

Going back to law school

“Comey’s Handling of Memos Is Investigated,” The Wall Street Journal, April 21, 2018 A1.

Apparently, the former head of the FBI (and a lawyer) considers memos he wrote in the course of his employment, about a meeting with his boss in his capacity as an employee, on his employer’s computers, to be personal documents, rather than government documents.  I don’t think he learned that at the University of Chicago’s Law School.

Forget, for the moment, whether these contained classified information, the leaking of which would be a crime a well as a violation of the duty of an employee.  He decided to transfer these memos to an outside party (a law professor!), so that they would be leaked to the press.  Another crime if classified information was involved.  But the law professor just became a member of a conspiracy involving the theft of government property.

But think about it from the employer’s point of view.  Didn’t Mr. Comey just convert an employer asset into a personal asset?  Allegedly, he created these contemporaneously as a business record.  Business records belong to the business.

I (another lawyer, mind you) take the view that everything an employee receives or creates in his or her role as an employee is the property of his/her employer.  How could a government employee decide to release them to the media in his/her role “‘as a private citizen.'”  Does this mean an employee of your company can decide on their own to broadcast your trade secrets, not as an employee, but as a private citizen?

Leave a comment

Filed under Compliance (General), Controls, Duty, Employees, Government, Information, Internal controls, Lawyers, Ownership

Catching up

I was out of town for a bit, and am now catching up  So this will deviate from the usual one-story, one-post format.  19 squibs.

“ISS Opposes Five Equifax Directors,” The Wall Street Journal, April 17, 2018 B2.  A proxy advisor recommends against voting for members of the Board’s technology committee, who had responsibility for technology security.  Is that all that happens, they get fired?  157 millions accounts exposed and they get un-elected but not (yet) sued?  No claw-back of director’s fees?

“Facebook Data Dispute Embroils University of Cambridge,” The Wall Street Journal, April 16, 2018 B4. Cambridge says Facebook approved of the University’s use of Facebook data.  Or your data, if you wish.

“Fired FBI No.2 McCabe Misled Probe, Report Says,” The Wall Street Journal, April 14, 2018 A1.  Misleading an internal investigation into leak to the newspaper is not good.

“Volkswagen Prepares to Replace CEO, The Wall Street Journal, April 11, 2018 B1.  CEO who help VW survive the emissions scandal gets replaced. A palace coup after the company spent $25 billion+ on the scandal.  Is this more price for VW to pay?  And let’s not forget the shareholders, who foot the bill.  See also “VW Picks Chief After Boardroom Coup,” The Wall Street Journal, April 13, 2018 B1.

“Blunder Hits Samsung Securities,” The Wall Street Journal, April 11, 2018 B13. An employee’s mistake leads to mistaken issuance of $105 billion in shares, more than 30 times the company’s existing issued shares.  Do you have the right controls in place?  Is this an information governance issue?

“Facebook Hearings Put Regulation In Spotlight,” The Wall Street Journal, April 12, 2018 A1. Will the Facebook data leak/usage lead to new privacy regulation?

“Adviser Urges Shift On Board Of Equifax,” The Wall Street Journal, April 12, 2018 B10.  Does the company’s failure to avoid a cyber attack mean the board has to go?  Maybe.

“China’s Censors Zero In on Apps,” The Wall Street Journal, April 12, 2018 B4.  Chinese government extends control over a smartphone app that had crude jokes.  Now there’s enforcement of a policy, and a demonstration of what “governance” means.

“Zuckerberg Says Sorry for Harm Done,” The Wall Street Journal, April 10, 2018 B4.  Classic crisis management strategy:  admit you’re wrong?

“Sensing Urgency, Facebook Bolsters User Protections,” The Wall Street Journal, April 10, 2018 B5.  Locking the door after the horse bolted.

“Facebook Sets ‘Issue’ Ads Rule,” The Wall Street Journal, April 7, 2018 A1.  Does a background check on advertisers protect your privacy?

“YouTube Policies Stir Bitterness,” The Wall Street Journal, April 6, 2018 B1.  Following attack at YouTube HQ, taking a closer look at YouTube’s policies on filtering/restricting content.

“Facebook CEO: Lax Privacy a ‘Huge Mistake,'” The Wall Street Journal, April 5, 2018 A1.  Not focusing on privacy protections a “huge mistake.”  Really?

“Police Want to Send AI Into the Street,” The Wall Street Journal, April 4, 2018 A3.  Can body cams be used to collect “Person of Interest”-level information, real time?

“WPP’s Sorrell Faces Probe,” The Wall Street Journal, April 4, 2018 B1.  CEO of advertising company under internal investigation for misusing company assets.  It’s really just a question of duty.

“GM Scraps a Standard in Sales Reporting,” The Wall Street Journal, April 3, 2018 B1.  You manage what you measure.  So, no longer reporting this statistic will reportedly make it easier to measure performance.  Huh?

“Oracle Defeats Google In Court,” The Wall Street Journal, March 28, 2018 B1. Appeals court revives copyright infringement suit against Google.  $9 billion+ in damages alleged.

“Wedbush Accused Of Flawed Oversight,” The Wall Street Journal, March 28, 2018 B12.  SEC charges company with failure to properly supervise an employee involved in “long-running ‘pump-and-dump’ scheme.”

 

Leave a comment

Filed under Accuracy, Board, Communications, Compliance, Compliance, Compliance (General), Controls, Corporation, Culture, Directors, Duty, Duty of Care, Employees, Governance, Information, Internal controls, Investor relations, Oversight, Oversight, Ownership, Ownership, Policy, Privacy, Protect information assets, Security, Third parties, Value

Privacy is dead; suspect under arrest

I don’t know what the record is for consecutive days on which one company’s screw-up was on the front page of The Wall Street  Journal, but Facebook is in the running.

“U.S., States Step Up Pressure on Facebook,” The Wall Street Journal, March 27, 2018 A1.  “[F]ederal regulators [including the FTC] … and 37 state attorneys general demanding explanations for [Facebook’s privacy] practices.” Stock price up 0.4% (when the market was up 669.40 points).  Demands/invitations that Zuckerberg (and Google and Twitter) testify before Congress.  And Europe hasn’t weighted in yet.

There is also a pop-up that describes FB’s practice of logging some calls and texts from Android phones.  Did you (we) know that?  Do you know what companies are doing with “your” data?  Do you care?  Privacy is dead; Facebook investigated as person of interest.

I guess that answers the question of who’s in charge:  the Feds and the states.  I guess I missed the outrage when essentially the same data was collected and used quite effectively by the Obama campaign.

Leave a comment

Filed under Compliance, Compliance (General), Controls, Corporation, Duty, Duty of Care, Governance, Government, Information, Internal controls, Legal, Oversight, Ownership, Privacy, Protect assets, Requirements, Third parties, Vendors, Who is in charge?