The purpose of this work program is to determine whether company policy and the structure of the security administration function provide for adequate administration of logical security. The information and guidelines in the work program can be used to audit the state of security administration.