Reference no: EM132238142

Assignment

Merchant's Bank of America (your employer), a merchant bank or "acquiring bank" has selected you to head up its IG Design, Development and Implementation team for the purpose of insuring an enterprise wide information governance program related to its merchant customers (depositors/account holders) who engage in credit card sales for whom you have placed point of sale terminals (POS) in their organization, and for those merchant customers who engage in internet sales for web hosting to capture your merchant customer's online credit card sales.

Recall from the introductory material provided, there is a third party credit card processor (Superior Credit Card Processor, Inc. "SCP") who will collect the information from your merchant customers credit card sales by using the POS/web hosting you have provided, and who will interact with the credit card associations, and by extension with the "Issuing Bank" to process the credit card transaction. Recall also, that the Issuing Bank will deduct its "interchange fee", forward the balance of the purchase money to SCP, who will deduct its own fee and well as your bank, Merchant's Bank of America's fee.

SCP will deposit your bank Merchant Bank of America's fee (discount) into an account earmarked to hold those credit card processing fees, and will then deposit the balance of your merchant customer's fee for the goods it sold on credit to its credit card purchasing customer into the merchant customer's checking account held with your bank.

For each of your merchant customers who are engaged in credit card sales, at the time SCP deposits Merchant Bank of America's credit card processing fee into MBA's account, and deposits MBA's merchant payment amount into the merchant's bank account with MBA, SCP will also provide MBA (your employer) with the details of each transaction.

At the end of the month, MBA will provide its merchant customers (depositors) with detailed information for each transaction. After all, the amount deposited into the merchant customer's bank account held with MBA will certainly show up as a "MERCHANT BANK DEPOSIT".

That is, it will appear on the merchant customer's bank statement as a deposit. For every single transaction wherein your merchant customers have allowed their customer to purchase something on credit using their credit card, you will get the detail of the transaction. SCP will send you the name of your merchant customer (depositor), their account information, the name and credit card information and transaction information for each customer of your merchant who made a credit card purchase.

The information you are provided will also include the dates of each transaction, the name and relevant information for the credit card holder's Issuing Bank, that bank's interchange fee charged for the transaction, SCP's fee charged, the fee that SCP withheld from your merchant customer's sales proceeds for you MBA's fee, and the net amount deposited into your merchant customer's checking account.

Ultimately, your team as part of the IG design and development process will be required to set up a records retention/disposal schedule for the information provided to MBA by SCP for the credit card sales of your merchant customers. To that end, you will need to first perform a records inventory.

1. You decide to use a two-step approach to conducting the records inventory, where you first send out survey questions to the appropriate departmental units, and then once you have reviewed the responses you will follow up by conducting face-to-face interviews to expand on answers and get more details to the initial questions you asked in the survey.

You will want to be able to speak intelligently to the knowledge personnel within the relevant departments who will be responsible for creating/storing/processing information for your merchant customers who have the POS terminals and/or internet sales capabilities, and who will receive the information from SCP for each of your merchant customer's credit card sales, and who will store that information, process it and provide the appropriate information to the merchant customer.

Therefore, you need to do some preparation and brainstorming before making contact with the department/units with whom you will be interacting for the purpose of the records inventory.

a. To that end, identify (using diagram, table, hierarch chart, taxonomy charge, or any other form or combination of forms that are most descriptive of the records type or data structure) what at this initial phase you expect will be contained in the records inventory. Remember, this is a starting point for you. You have to give this some thought before you know what to ask these knowledge people in the departments you will survey/interview.

Use descriptive names for each record type and tell the type of information you expect will be included in each record type. If you decide to use something as specific as a taxonomy, you may want to refer to Appendix A of your text book. Or, in the alternative, you may conduct research and determine what other structure would be most appropriate in order to convey this information.

Regardless of the form you choose to use, include in your brainstorming approach a description of the record types (as explained above), departments responsible for creating, maintaining, storing, reporting, etc. that information. This will probably involve creating more than one record series. Don't limit yourself. In addition, you should include information about what type of event would trigger the creation and/or destruction of the record type created.

b. Based upon the records/record series you have identified above, develop an initial records retention/destruction schedule for each. That is, for each record type explain how long you expect to retain the record type or series, and then once marked for destruction,  explain the method of destruction you expect would be used. When you plan to use event-based retention/destruction, identify the triggering event. For this question, consider the legal requirements and compliance considerations.

c. Once you have developed or designed your record series, please explain or describe this in narrative form. I WILL NOT ACCEPT just a table with no explanation. Remember, while tables or diagrams are useful, they will not substitute as your narrative explanation. Tell what each record series describes, and a justification for its content.

2. Develop a Record Inventory Survey Form that you are going to use in surveying the departmental unit(s) that you have identified above as relevant. The purpose of your survey is to be able to identify the kinds of records each department "owns", which other department(s) need access to the record series, what applications(s) create the record series, where the record is physically and logically stored, the date created, last changed, whether  it is a vital record, and whether there are other forms of the record (is it redundant?).

You want to be able to use this information to make decisions related to retention and disposal of records, as well as identifying how you can achieve your high level goals and resolve issues or problems related to retention and disposal (keeping records beyond the period of time you need to keep them, not keeping information that is necessary for legal defense of the organization, retaining information that PCI DSS forbids, release of protected information, etc.).

Of course, you will have a set of survey questions that is not "narrative". In addition to the Records Inventory Survey Form, explain in narrative form your general logic in developing the survey the way you did. That is, who was the target, why you chose to go in a certain
direction with the survey questions (what you hoped to achieve with them), and why you left out certain things, possibly to include in your interviews to be conducted later.

3. Develop an initial set of interview questions that you plan to use as a follow up to the initial survey that you drafted in question 2 above. That is, what kinds of information that you included on your initial records inventory survey will require more specifics once you can speak with the knowledge individuals who answered the initial survey.

Your response to this question will include list of survey questions on a form you would want to use to take with you when you conduct your follow up interview. In addition, give me a narrative explanation explaining how you went about deciding what to include on the interview, what you hope to achieve by it, etc.