All login attempts should be checked carefully, with realistic security in place such as a
limited number of login attempts before the account is blocked. Passwords should be
tested to ensure that they are reasonably secure. The website should not permit web
browsers to “remember” passwords so that login can be automatic.
M plc should pursue action against any subscriber whose use of the website brings the
company into disrepute. If it does so in a very public way then it may deter any further
such acts. It may also help to demonstrate that M plc is behaving honestly and in the
public interest.
There should be a facility for anybody who reads a post to flag it as inappropriate.
Hopefully that would mean that electronic subscribers will flag up a number of
unacceptable statements that do not trigger the automatic filters. Clicking on this
notification could hide the post until it has been reviewed by one of M plc’s staff and
confirmed as fit for publication.
(b)
(i) All staff look to the control environment in order to decide whether behaviour is
acceptable or not. The control environment is essentially the attitude of senior
management towards the control system’s operation and effectiveness. Arguably, it is the
exception that proves the rule. Mismanagement and misbehaviour will be accepted
according to custom and practice if action is not taken.
(ii) It appears that the directors have been receiving monthly management accounts that
have shown increasing costs associated with journalist expenses. This increase has not
been budgeted and there has been no investigation until now. The message that has
been communicated to journalists is that the board is perfectly happy to tolerate such
extravagance.
Presumably, expenses have either been paid without any further authorisation or those
responsible for authorising payments have been happy to sign almost anything without
considering whether the cost is justified or not. It may be that M plc has created a culture
in which journalists believe that they are entitled to eat in the best restaurants or to buy
expensive equipment at the company’s expense. If colleagues share stories about such
claims then all staff will quickly feel that this behaviour is the norm.
The fact that editors do not believe that they can refuse claims suggests that they have
had insufficient support from senior management. The board has made it difficult for
editors to enforce acceptable standards of behaviour by allowing these costs to spiral out
of control. Editors will find it difficult to exert their authority if they cannot rely on senior
management to support them when faced with a dispute with a journalist over expenses.
(iii) The internal audit department is generally responsible for monitoring compliance with
rules. The very nature of a journalist’s expense claims make it difficult to set hard and fast
rules. For example, setting a fixed upper limit for the cost of a meal may be embarrassing
when a journalist has to interview a senior politician or business leader.
The internal audit department will find these rules difficult to investigate because of the
lack of clear and observable benchmarks for acceptable claims. Such reviews could
involve asking the journalist who lodged a claim to explain why it was appropriate to
spend that amount under those circumstances. Such reviews could cause some
resentment on the part of journalists who feel that their expenses are a necessary part of
their effectiveness in gathering news and writing stories. That risk could be reduced if the
internal audit department approaches these reviews with an open mind and gives the
subjects of the investigations the opportunity to explain why a particular choice was made
when there may have been a less expensive alternative.