Are the firm’s IT planning and control processes appropriate?