A Framework for Organisational Control Principles

Just as organisations have goals describing their primary business objectives, they also have goals with respect to controlling how these objectives are met. These are the control goals of an organisation which are enforced through a system of internal control. Such a system enables them to adhere to external laws and internal regulations, prevent and detect fraud and continuously enhance the overall quality of the business. Independent of the type of organisation, these internal control systems use common underlying principles to establish and achieve control over business activities. Some of these principles have been previously described and analysed within the context of existing roleand policy-based frameworks. These descriptions, however, never explicitly consider the organisational background of these principles. Other principles have not received any attention at all. What is required is to provide a unifying representation of control principles allowing for their extended analysis and exploration. This thesis presents a framework suitable to express and analyse a set of selected control principles. It consists of three main parts: 1. A review and discussion of organisational control principles, their origin, relationships, and existing roleand policy-based frameworks that partially support their expression; 2. A formal model for organisational control principles on the basis of which we define, analyse, discuss and explore: • separation controls; • delegation and revocation controls; • review and supervision controls; 3. A case study consisting of two parts, the first part describing the access control system and applied control principles of a major European bank, the second part using the domain example of a branch of that bank for the validation of our framework. The Alloy specification language and its facilities for automated analysis are used to specify the components of the framework and explore their relationships. The conclusion of this thesis is that a general framework for control principles is feasible, and provides valuable insights into their relationships and use.