The introduction of client server systems raises some serious IS control concerns. Although client server systems increase system flexibility and compatibility, and facilitates system downsizing and process restructuring, multiple operating systems, database management systems, and platforms of client-server system increase th potential exposures and risks of the system. It is needed to recommend the effective control framework to mitigate risks. This paper suggests risks and control framework for client server system. The results of two case studies indicate that program and database management are important as program and data should be located and maintained in client and servers. It becomes difficult to manage divided programs and data logic that are distributed across clients and servers that have different platforms. The case studies of two banks show that the extent of distribution of program and data logic affects the importance of program and database management controls.