4A OR nA

A typical control framework covers four areas:

* Authentication and authorization: no individual should have more rights than he or she needs to execute his or her assigned tasks. The organization should also maintain a complete record of access and activities.

* Configuration and change management: no changes should be made without authorization. A record of what changes are made should be maintained so that the state of a system or application at a previous time can be determined.

* Segregation of duties: a single person should not have the right to configure IT systems as well as audit, initiate or approve incompatible activities in those systems.

* Documentation: all entities must be held accountable. Compliance should be documented and tested on an ongoing basis. The audit trail should allow for testing of the internal IT control framework as well as substantiating regulatory compliance.