An organization's senior management thinks current security controls may be excessive and requests an IS auditor's advice on how to assess the adequacy of curre...