1. How should John Petrie handle the fact that, realistically, not all security issues are equally important? In any case, how do you define importance in this context?

2. What does the reporting structure of a company say about the importance of a particular function or department? What changes, if any would you make at Harland Clarke?

3. How do you get people who are not usually security-conscious, or at least never had to be, to be more aware of the potential security implications of their daily routines? What kind of initiatives would you introduce? Provide some examples.