Using data envelopment analysis and decision trees for efficiency analysis and recommendation of B2C controls

a r t i c l e i n f o Keywords: B2C applications B2C controls Data envelopment analysis (DEA) Decision trees Implementation of B2C applications Appropriate guidelines for controls in B2C (business-to-consumer) applications (hereafter B2C controls) should be provided such that these guidelines accomplish efficiency of controls in the context of specific system environments, given that many resources and skills are required for the implementation of such controls. This study uses a two-step process for the assessment of B2C controls, i.e., efficiency analysis and recommendation of controls. First, using a data envelopment analysis (DEA) model, the study analyzes the efficiency of B2C controls installed by three groups of organizations: financial firms, retail firms, and information service providers. The B2C controls are composed of controls for system continuity, access controls, and communication controls. DEA model uses B2C controls as input and three variables of implementation of B2C applications, i.e., volume, sophistication, and information contents as output. Second, decision trees are used to determine efficient firms and generate rules for recommending levels of controls. The results of the investigation of the DEA model indicate that retail firms and information service providers implement B2C controls more efficiently than financial firms do. Controls for system continuity are implemented more efficiently than access controls. In financial firms, controls for system continuity, communication controls, and access controls, in a descending order, are efficiently adopted in B2C applications. Every company can determine its relative level of reduction in each component of controls in order to make the control system efficient. The firms that efficiently implement B2C controls are determined using a decision tree model. The decision tree model is further used to recommend the level of controls and suggest rules for controls recommendation. This suggests the possibility of using decision trees for controls assessment in B2C applications. As organizations rely increasingly on IS (information Systems) for strategic advantage and operations, management needs to pay more attention to IS security issues due to a corresponding increase in the impact of IS security abuses. Controls of e-business applications should ensure the security, integrity, auditability, and controllability of the configured software, data, and support organization [16]. As controls are not only expensive to put in place and operate, but also increase audit efforts and slow down the execution of business processes, it is necessary to automate controls in an optimum manner from a cost and regulatory perspective [28]. How …