Purpose – This paper leverages the concept of business information intensity (BII) with the aim of developing a model to assess control deficiency risk (CDR) in organizations. BII measures the extent of use of IT by an organization in its products and value chain. Design/methodology/approach...