Problem:
All Clear Company is a large manufacturer of custom draperies. In all, the company has seven divisions spread out across the country. Furthermore, the company has adopted a policy of issuing digital certificates for all company transactions, and it has even decided to issue digital credentials for all key employees. The typical employee's credentials contain the employee's social security number, name, position in the company, public key, and any special authorizations to act on the company's behalf. For example, the purchasing officers all contain credentials that contain the words "Authorized Purchasing Officer." All credentials are digitally signed using the company's general private key.
A dispute has arisen between management, accounting, and finance regarding the proper procedures for issuing the digital credentials. Accounting argues that a major control issue is at stake and that it should process all credentials. Management sees no need for accounting's involvement and argues that it alone should do the processing. Finance, on the other hand, argues that digital credentials are like keys to the safety deposit box, or to the signature signing machine. Therefore, finance feels that it should assume sole responsibility for processing the digital credentials.
Required to do:
Q1. What function (accounting, finance, or management) should process the digital credentials? In formulating your answer, keep in mind at least the following considerations:
a. Segregation of duties
b. The types of credentialing that might be done
c. The ability of the function to handle the type of work required
Q2. What procedures should be followed in issuing the digital credentials?