Controlling the Data Base Administrator

The data base administrator (DBA) function is an essential element of a properly operated data base system. Although the vast majority of DBAs maintain the highest ethical standards, it must be recognized that these individuals are commonly in a particularly powerful position with respect to the organization's information systems, possessing the ability to inflict significant harm. This article describes the typical functions of a DBA and the specific methods that a DBA could employ to manipulate an organization's data base for personal gain, for the gain of others, or for misdirected benefit to the organization itself. In addition, this article discusses a variety of internal control procedures that can be used to effectively mitigate the risk of such inappropriate activity. Finally, warning signs that may indicate an increased risk of inappropriate DBA activity are presented.