Preventing Identity Theft in Your Business

APPENDIX DCAUSE-AND-EFFECT ANALYSIS: STEP-BY-STEP INSTRUCTIONS

Cause-and-effect analysis builds on and organizes the ideas generated in brainstorming. The Business Information Security Program (BISP) adapts the cause-and-effect analysis method from the management sciences to organize the list of identities generated in brainstorming sessions.

Cause-and-effect analysis uses the quality management fishbone framework.

According to this quality management theory, the source of all management problems can be attributed to four Ms: manpower, methods, machine, and materials.

In the context of the BISP model, manpower refers to people; methods are the work processes, policies, or procedures; the machines refer to all types of equipment and represents property; and material also may be property, in the form of documents, application forms, and any other products used to perform the job tasks.

As an example, exercises in Chapter 8 identify the incoming sources of identities into a department. If documents containing personal information are hand delivered, “hand delivery” would be a source categorized under manpower, and if personal information is also delivered through a phone conversation, the source term “telephone” would be categorized and listed under the heading “machines,” and so on.

The cause-and-effect fishbone four-M framework is used throughout for problem-solving exercises. The items shown on the fishbones in Exhibits D.1 and D.2 were borrowed from the flip chart of one company ...