The internal auditor is reviewing a new policy on electronic
mail. Appropriate elements of such a policy would include all of
the following except:

(a) The requirement is to identify the least likely part of
a company’s policy on electronic mail. Answer (a) is correct
because the company should have access to the business-related
e-mail that is left behind. Access to e-mail can also be critical in
business or possible criminal investigations. The privacy concerns
of the individual case must be mitigated by compelling
business interests: the need to follow up on business e-mail and
to assist in investigations. Answer (b) is incorrect because encryption
helps prevent eavesdropping by unauthorized persons
trying to compromise e-mail messages. Answer (c) is incorrect
because limiting the number of packages would decrease the
number of administrators who might have access to all messages.
Answer (d) is incorrect because controlling the transmission of
confidential information by e-mail will help avoid theft of information
through intrusion by outsiders.