How you would demonstrate, by example, the importance of security and then propose a method for creating a "security aware" culture. Also how would you evaluate how much accountability for AIS security falls on management in a large and a small accounting firm.