"But it is unfair to burden the information technology department with the entire compliance effort because there are other non-I.T. requirements relating to areas such as finance, human resources and physical security which should be engaged." . . . . .