KPMG recommend that IT/IS policies and procedures should be formally developed. The policies and procedures ideally receive formal board approval in order to emphasize the importance and to raise high awareness for all employees. The following topics should be included in IT/IS policies and procedures: