EPCS Third party audits the CPA perspective. 13 September 2012
|
|
|
- Austin Morrison
- 7 years ago
- Views:
Transcription
1 EPCS Third party audits the CPA perspective 13 September 2012
2 Agenda Introduction History Report review Audit process Moving forward
3 Introduction
4 Application provider requirements Third-party audits or certifications. (a) Except as provided in paragraph (e) of this section, the application provider of an electronic prescription application or a pharmacy application must have a third-party audit of the application that determines that the application meets the requirements of this part at each of the following times: (1) Before the application may be used to create, sign, transmit, or process controlled substance prescriptions. (2) Whenever a functionality related to controlled substance prescription requirements is altered or every two years, whichever occurs first. (b) The third-party audit must be conducted by one of the following: (1) A person qualified to conduct a SysTrust, WebTrust, or SAS 70 audit. (2) A Certified Information System Auditor who performs compliance audits as a regular ongoing business activity. (c) An audit for installed applications must address processing integrity and determine that the application meets the requirements of this part. (d) An audit for application service providers must address processing integrity and physical security and determine that the application meets the requirements of this part.
5 Personal Background Chris Halterman, Executive Director, Ernst & Young Advisory Services Chair American Institute of Certified Public Accountants (AICPA) Trust/Data Integrity Task Force 24 years performing audits in the healthcare industry Chaired AICPA efforts to address EPCS reporting
6 And now terminology Criteria--are the standards or benchmarks used to measure and present the subject matter and against which the practitioner evaluates the subject matter. Trust Services criteria a set of criteria used to evaluate internal control of a System as it relates to security, availability, processing integrity, confidentiality and privacy SysTrust SM and WebTrust SM Reports accounts audit reports that use the trust services criteria to evaluate systems and e-commerce systems, respectively. SAS 70 Report an audit on controls relevant to user entities internal control over financial reporting. Replace by a Service Organization Control 1 report (often referred to as a SOC 1 or SSAE 16 report) A person qualified to conduct a SysTrust, WebTrust, or SAS 70 audit a Certified Public Accountant licensed by the state board of accountancy of the state in which the report is to be issued Certified Information System Auditor (CISA) a person who has passed the CISA exam and meets the education requirements established by ISACA (formerly, the Information Systems Audit and Control Association)
7 Goals Understand what is required Understand how the requirements were established Understand what it means for your organization Identify developing issues
8 AICPA Operation Model for New Reports Understand the needs of the users Identify the criteria to be used Evaluate the criteria for suitability Draft a model report Provide guidance to CPAs
9 History
10 Events to date AICPA become aware of interim final rule Responsibility assigned to Trust/Data Integrity Task Force Working group created to understand the requirements of the Rule Interaction with industry leaders Draft report created/sent to DEA Comments received from DEA Changes made in response to DEA comments Revised report submitted to DEA Guidance published by AICPA
11 Analysis of requirements a third-party audit of the application that determines that the application meets the requirements of this part Identification of the requirements Evaluation of the requirements to meet the definition of suitable criteria The third-party audit must be conducted by one of the following: (1) A person qualified to conduct a SysTrust, WebTrust, or SAS 70 audit. note that the Rule does not require the report to conform to one of these 3 types. Gave the AICPA the flexibility needed to develop a report that met the DEA requirements
12 Analysis of requirements (continued) An audit for installed applications must address processing integrity and determine that the application meets the requirements of this part. Relationship of an installed application to a system to evaluate processing integrity Concept of processing integrity (d) An audit for application service providers must address processing integrity and physical security and determine that the application meets the requirements of this part. Implications of application as a service Consideration of processing integrity and physical security
13 Report review
14 AICPA illustrative reports high level review est/reporting/downloadabledocuments/dea_re ports.pdf
15 Criteria All software Rule requirements Installed software and application service providers Trust Services criteria relevant to processing integrity and security Policies Communication Risk assessment Logical access Application development Controls over input, processing and output Monitoring
16 Audit process
17 Steps in the audit Defining the system Testing date/period Testing environment Processing integrity and security Engagement agreement Information requests Resolution of testing issues Reporting
18 Controlling costs Auditor costs Joint project management Personnel availability Recordkeeping Issue resolution Turn-around time Internal costs Time commitment of key personnel Delays Miscommunication/misinformation
19 Tips for working with auditors Organization of requested information Understanding Responsiveness Others?
20 Moving forward
21 Challenges When to start testing Rate of adoption Other healthcare system spending priorities Retesting issue
22 Special thanks to Steve Kelleher for his guidance and assistance
23 Questions?
24 Contact information Chris Halterman Ernst & Young LLP 801 Grand Avenue, Suite 3000 Des Moines, Iowa
Service Organization Controls. Managing Risks by Obtaining a Service Auditor s Report
Service Organization Controls Managing Risks by Obtaining a Service Auditor s Report Contributing Authors Audrey Katcher, CPA/CITP, Partner at RubinBrown, LLP Janis Parthun, CPA/CITP, Sr. Technical Manager
Cybersecurity and the AICPA Cybersecurity Attestation Project
Cybersecurity and the AICPA Cybersecurity Attestation Project Chris Halterman Executive Director EY Chair AICPA Trust Information Integrity Task Force 2 October 2015 Increasing awareness of cybersecurity
CSA Position Paper on AICPA Service Organization Control Reports
CSA Position Paper on AICPA Service Organization Control Reports February 2013 2013, Cloud Security Alliance. All rights reserved. You may download, store, display on your computer, view, print, and link
Service Organization Controls. Managing Risks by Obtaining a Service Auditor s Report
Service Organization Controls Managing Risks by Obtaining a Service Auditor s Report Contributing Authors Audrey Katcher, CPA, CITP, Partner at RubinBrown, LLP Janis Parthun, CPA, CITP, Sr. Technical Manager
SECURITY AND EXTERNAL SERVICE PROVIDERS
SECURITY AND EXTERNAL SERVICE PROVIDERS How to ensure regulatory compliance and manage risks with Service Organization Control (SOC) Reports Jorge Rey, CISA, CISM, CGEIT Director, Information Security
Re: Docket No. DEA-218, Electronic Prescriptions for Controlled Substances, Interim Final Rule with Request for Comment
American Society of Health-System Pharmacists 7272 Wisconsin Avenue Bethesda, Maryland 20814 (301) 657-3000 Fax: (301) 664-8877 www.ashp.org Drug Enforcement Administration Attention: DEA Federal Register
Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International. Understanding SOC 3
Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International. Understanding SOC 3 Agenda 1) A brief perspective on where SOC 3 originated
SAS No. 70, Service Organizations
SAS No. 70, Service Organizations A standard for reporting on a service organization s controls affecting user entities' financial statements. Only for use by service organization management, existing
Goodbye, SAS 70! Hello, SSAE 16!
Goodbye, SAS 70! Hello, SSAE 16! A Session to Provide Insight on the New Standard and What Service Providers and End-Users Need to Know January 3, 2012 Agenda Introduction Background on what was SAS 70
SERVICE ORGANIZATION CONTROL REPORTS SM. Formerly SAS 70 Reports
SERVICE ORGANIZATION CONTROL REPORTS SM Formerly SAS 70 Reports SAS No. 70, Service Organizations Standard for reporting on a service organization s controls affecting user entities financial statements
Update on AICPA Assurance Services Executive Committee Activities
Update on AICPA Assurance Services Executive Committee Activities Amy Pawlicki Director Business Reporting, Assurance & Advisory Services and XBRL AICPA Agenda ASEC overview Summary of work streams by
Service Organization Control Reports
SAS 70 ENDS EXIT TO SSAE 16 Service Organization Control Reports What Did We Learn from Year One? Agenda Definitions Service Organization Reports What are they? Year One Experiences SSAE 16 Year One Experiences
Reports on Service Organizations Where we ve been?
Reports on Service Organizations Where we ve been? What s changing? How does this impact Internal Audit? Eric Wright Shareholder Frank Dezort Senior Manager Schneider Downs & Co., Inc. May 2, 2011 Overview
Frequently asked questions: SOC 2 and 3
1. Is the licensing requirement for a SOC 2 or 3 different than for a SOC 1? SOC reports are attestation reports issued in accordance with AICPA standards. Therefore, licensing requirements are the same
Feeley & Driscoll, P.C. Certified Public Accountants / Business Consultants www.fdcpa.com. Visit us on the web: www.fdcpa.com Or Call: 888-875-9770
Feeley & Driscoll, P.C. Certified Public Accountants / Business Consultants www.fdcpa.com SAS 70 Background 2 SAS No. 70 Reports on the Processing of Transactions by Service Organizations Independent examination
Service Organization Control (SOC) reports What are they?
Service Organization Control (SOC) reports What are they? Jeff Cook, CPA, CITP, CIPT, CISA June 2015 Introduction Service Organization Control (SOC) reports are on the rise in the IT assurance and compliance
Update on Industry Progress in Implementing Electronic Prescribing for Controlled Substances
Update on Industry Progress in Implementing Electronic Prescribing for Controlled Substances To: State Boards of Pharmacy State Controlled Substance Agencies State and National Pharmacy Organizations From:
Service Organization Control (SOC) Reports Focus on SOC 2 Reporting Standard
Information Systems Audit and Controls Association Service Organization Control (SOC) Reports Focus on SOC 2 Reporting Standard February 4, 2014 Tom Haberman, Principal, Deloitte & Touche LLP Reema Singh,
Farewell to SAS 70. What you need to know about the New Standard for Service Organization Reporting
Farewell to SAS 70 What you need to know about the New Standard for Service Organization Reporting ADVISORY rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative
Monitoring Outside Service Providers, Part III: SAS 70 Updates
Monitoring Outside Service Providers, Part III: SAS 70 Updates Richard F. Fischer, CPA Louis Plung & Company, LLP richard.fischer@louisplung.com 412-281-8771 CHANGES TO SAS 70 SERVICE ORGANIZATIONS: Statement
Shared Service System Audits: What User Management and Auditors Need to Know
Shared Service System Audits: What User Management and Auditors Need to Know JFMIP May 2014 Presented by: Robert Dacey GAO Session Objectives Properly using SSAE 16 service organization audit reports Revisions
Effectively using SOC 1, SOC 2, and SOC 3 reports for increased assurance over outsourced operations. kpmg.com
Effectively using SOC 1, SOC 2, and SOC 3 reports for increased assurance over outsourced operations kpmg.com b Section or Brochure name Effectively using SOC 1, SOC 2, and SOC 3 reports for increased
SECTION I INDEPENDENT SERVICE AUDITOR S REPORT
SOC2 Security Report on Controls Supporting DriveSavers Services Independent Service Auditor s Report on Design of Controls Placed in Operation and Tests of Operational Effectiveness Relevant to Security
SSAE 16 Everything You Wanted To Know But Are Afraid To Ask. Kurt Hagerman CISA, CISSP, QSA Managing Director, Coalfire December 8, 2011
SSAE 16 Everything You Wanted To Know But Are Afraid To Ask Kurt Hagerman CISA, CISSP, QSA Managing Director, Coalfire December 8, 2011 1 Agenda SAS 70 Misunderstood and Overused o Why the change? SSAE
Information for Management of a Service Organization
Information for Management of a Service Organization Copyright 2011 American Institute of Certified Public Accountants, Inc. New York, NY 10036-8775 All rights reserved. For information about the procedure
SOC Readiness Assessments. SOC Report - Type 1. SOC Report - Type 2. Building Trust and Confidence in Third-Party Relationships
Building Trust and Confidence in Third-Party Relationships Today s businesses rely heavily on outsourcing certain business tasks or functions to service organizations, even those that are core to their
FAQs New Service Organization Standards and Implementation Guidance
FAQs New Service Organization Standards and Implementation Guidance During the past two years several significant changes have occurred in audit and attest standards for reporting on controls at service
The Changing SAS 70 Landscape Dan Hirstein Director Rebecca Goodpasture Senior Manager Deloitte & Touche LLP January 13, 2011
The Changing SAS 70 Landscape Dan Hirstein Director Rebecca Goodpasture Senior Manager Deloitte & Touche LLP January 13, 2011 Table of Contents A Short History of SAS 70 Overview of SSAE 16 and ISAE 3402
ASSESSMENT REPORT 13 19. Federal PKI Compliance Report September 6, 2013
ASSESSMENT REPORT 13 19 Federal PKI Compliance Report September 6, 2013 Date September 6, 2013 To Chief Information Officer From Inspector General Subject Assessment Report Federal PKI Compliance Report
California State Board of Pharmacy and Medical Board of California
California State Board of Pharmacy and Medical Board of California Transmission and Receipt of Electronic Controlled Substance Prescriptions Pursuant to DEA Interim Final Rule (IFR): Electronic Prescriptions
About the Presenter. Presentation Objectives. SaaS / Cloud Computing Risk Management AICPA Attest Alternatives
SaaS / Cloud Computing Risk Management AICPA Attest Alternatives Presenter: Dan Schroeder, CPA/CITP Habif, Arogeti, & Wynne, LLP Georgia Society of CPAs Annual Convention June 16, 2010 About the Presenter
Cloud Computing An Auditor s Perspective
Cloud Computing An Auditor s Perspective Sailesh Gadia, CPA, CISA, CIPP sgadia@kpmg.com December 9, 2010 Discussion Agenda Introduction to cloud computing Types of cloud services Benefits, challenges,
WRITTEN TESTIMONY OF AICPA EMPLOYEE BENEFIT PLAN AUDIT QUALITY CENTER EXECUTIVE COMMITTEE
WRITTEN TESTIMONY OF AICPA EMPLOYEE BENEFIT PLAN AUDIT QUALITY CENTER EXECUTIVE COMMITTEE BEFORE THE ERISA ADVISORY COUNCIL REGARDING OUTSOURCING EMPLOYEE BENEFIT PLAN SERVICES AUGUST 19, 2014 The Employee
Audit, Review, Compilation, and Preparation of Financial Statements
Audit, Review, Compilation, and Preparation of Financial Statements DISCLAIMER: This publication has not been approved, disapproved or otherwise acted upon by any senior technical committees of, and does
Risky Business. Is Your Cybersecurity in Cruise Control? ISACA Austin Chapter Meeting May 5, 2015
Risky Business Is Your Cybersecurity in Cruise Control? ISACA Austin Chapter Meeting May 5, 2015 What We ll Cover About Me Background The threat Risks to your organization What your organization can/should
Cloud Computing Risk Assessment
Cloud Computing Risk Assessment A Case Study Sailesh Gadia, CISA, ACA, CPA, CIPP, is a director/senior manager at KPMG s advisory practice in Minneapolis, Minnesota, USA. He has an extensive background
Vendor Management Best Practices
23 rd Annual and One Day Seminar Vendor Management Best Practices Catherine Bruder CPA, CITP, CISA, CISM, CTGA Michigan Texas Florida Insight. Oversight. Foresight. SM Doeren Mayhew Bruder 1 $100 billion
G13 USE OF RISK ASSESSMENT IN AUDIT PLANNING
IS AUDITING GUIDELINE G13 USE OF RISK ASSESSMENT IN AUDIT PLANNING The specialised nature of information systems (IS) auditing and the skills necessary to perform such audits require standards that apply
The Finance & Audit (F&A) Committee is expected to consider F&A Committee Agenda Item 4: at its meeting on December 7, 2015.
The Finance & Audit (F&A) Committee is expected to consider F&A Committee Agenda Item 4: Recommendation regarding Acceptance of 2015 Service Organization Control (SSAE 16) Audit Report at its meeting on
TIS Section 9520, SSAE No. 16, Reporting on Controls at a Service Organization
November 2011 AICPA Technical Practice Aids TIS Section 9520, SSAE No. 16, Reporting on Controls at a Service Organization.01 New Standards for Service Auditors and User Auditors Inquiry Did the issuance
Understanding ISO 27018 and Preparing for the Modern Era of Cloud Security
Understanding ISO 27018 and Preparing for the Modern Era of Cloud Security Presented by Microsoft and Foley Hoag LLP s Privacy and Data Security Practice Group May 14, 2015 Proposal or event name (optional)
Understanding SOC Reports for Effective Vendor Management. Jason T. Clinton January 26, 2016
Understanding SOC Reports for Effective Vendor Management Jason T. Clinton January 26, 2016 MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2012 Wolf & Company, P.C. Before we
Service Organization Control (SOC) Reports
Service Organization Control (SOC) Reports Transitioning from SAS 70 to SSAE 16 Deloitte & Touche LLP Agenda Overview SAS 70/SSAE 16 Historical Perspective The New Framework Under SSAE 16 (SOC 1) Impact
GUIDELINES INDEPENDENT CERTIFIED PUBLIC ACCOUNTANTS PERFORMING FINANCIAL STATEMENT AUDITS OF STATE AGENCIES
GUIDELINES TO INDEPENDENT CERTIFIED PUBLIC ACCOUNTANTS PERFORMING FINANCIAL STATEMENT AUDITS OF STATE AGENCIES STATE AUDITOR Robert R. Peterson 1 GUIDELINES TO CERTIFIED PUBLIC ACCOUNTANTS PERFORMING FINANCIAL
OFFICE OF AUDITS & ADVISORY SERVICES CLOUD COMPUTING AUDIT FINAL REPORT
County of San Diego Auditor and Controller OFFICE OF AUDITS & ADVISORY SERVICES CLOUD COMPUTING AUDIT FINAL REPORT Chief of Audits: Juan R. Perez Audit Manager: Lynne Prizzia, CISA, CRISC Senior Auditor:
AHIA HCCA Auditing & Monitoring Focus Group Defining the Key Roles and Responsibilities Corporate Compliance and Internal Audit.
and Requirement: May be required if the organization must comply with Sarbanes-Oxley. Otherwise, is implemented as an organizational governance/business decision and best practice. Purpose: Provide independent
Prüfung von Outsourcing mit SAS70
Prüfung von Outsourcing mit SAS70 AGENDA Historical flashback Reasons for the standard Major contents Potential areas of SAS 70 application Audit approach and Responsibility Client and Service Provider
At a glance. A provision to require a written assertion from company management is the most notable difference between the two standards.
At a glance While there are some differences, SAS 70 and SSAE 16 are substantially the same. SAS 70 is an audit standard while SSAE 16 is an attest standard. Out with the old SAS 70 and in with the new
Webtrends Inc. Service Organization Controls (SOC) 3 SM Report on the SaaS Solutions Services System Relevant to Security
Webtrends Inc. Service Organization Controls (SOC) 3 SM Report on the SaaS Solutions Services System Relevant to Security For the Period January 1, 2015 through June 30, 2015 SOC 3 SM SOC 3 is a service
THE DATA CENTER COMPLIANCE ACRONYMS YOU NEED TO KNOW
THE 22 DATA CENTER COMPLIANCE ACRONYMS YOU NEED TO KNOW In today s world, data center compliance is no joke, and firewalls aren t enough to keep your data safe. Whether you re outsourcing or housing your
IAASB Main Agenda (June 2010) Agenda Item. April 28, 2009
Agenda Item 8-B Statement of Position 09-1 April 28, 2009 Performing Agreed-Upon Procedures Engagements That Address the Completeness, Accuracy, or Consistency of XBRL-Tagged Data Issued Under the Authority
ISO 9001 Quality Management System Lead Auditor Training (IRCA)
ISO 9001 Quality Management System Lead Auditor Training (IRCA) Course Description BSI s Quality Management Systems (QMS) Auditor/Lead Auditor Training Course (ISO 9001) course teaches the principles and
CFPB Readiness Series: Compliant Vendor Management Overview
CFPB Readiness Series: Compliant Vendor Management Overview Legal Disclaimer This information is not intended to be legal advice and may not be used as legal advice. Legal advice must be tailored to the
The 7 Deadly Sins of SAS 70 s
ASSURANCE AND ADVISORY BUSINESS SERVICES The 7 Deadly Sins of SAS 70 s Presented by: Christopher Mitchell, MBA, CIA, CISA, CCSA 1 Seven Deadly Sins Lust (obsessive or excessive thoughts) Gluttony (over-indulgence)
WELCOME TO SECURE360 2013
WELCOME TO SECURE360 2013 Don t forget to pick up your Certificate of Attendance at the end of each day. Please complete the Session Survey front and back, and leave it on your seat. Are you tweeting?
Role is Broader and More Strategic
Internal Control Transformation IC s Role is Broader and More Strategic CACUBO Winter Workshop - 2013 Introduction Cindy Berg Director McGladrey LLP 201 N Harrison Street Davenport, Iowa 52801 cindy.berg@mcgladrey.com
A Planning Guide for Electronic Prescriptions for Controlled Substances (EPCS)
A Planning Guide for Electronic Prescriptions for Controlled Substances (EPCS) The Federal Drug Enforcement Administration (DEA) regulates prescriptions of controlled substances that have risks for abuse.
Effective Monitoring of Outsourced Plan Recordkeeping and Reporting Functions
Effective Monitoring of Outsourced Plan Recordkeeping and Reporting Functions Plan Advisory The AICPA EBPAQC is a firm-based, volunteer membership center created with the goal of promoting quality employee
May 21, 2010. Docket No. DEA-218. Dear Drug Enforcement Administration;
May 21, 2010 Drug Enforcement Administration Attention: DEA Federal Register Representative/ODL 8701 Morrissette Drive Springfield, VA 22152 dea.diversion.policy@usdoj.gov Re: Docket No. DEA-218 Dear Drug
Re: Docket No. DEA-218, Electronic Prescriptions for Controlled Substances
American Society of Health-System Pharmacists 7272 Wisconsin Avenue Bethesda, Maryland 20814 (301) 657-3000 Fax: (301) 664-8877 www.ashp.org Drug Enforcement Administration Attention: DEA Federal Register
TERMS OF REFERENCE OF THE AUDIT COMMITTEE UNDER THE BOARD OF DIRECTORS OF CHINA PETROLEUM & CHEMICAL CORPORATION
TERMS OF REFERENCE OF THE AUDIT COMMITTEE UNDER THE BOARD OF DIRECTORS OF CHINA PETROLEUM & CHEMICAL CORPORATION Chapter 1 General Provisions Article 1 These Terms of Reference (these Terms ) are established
Copyright 2015, American Institute of Certified Public Accountants, Inc. All Rights Re... STATEMENT ON STANDARDS FOR CONSULTING SERVICES
Page 1 of 7 Consulting Services CS Section STATEMENT ON STANDARDS FOR CONSULTING SERVICES Statements on Standards for Consulting Services are issued by the AICPA Management Consulting Services Executive
Risk & Control Considerations for Outsourced IT Operations
Risk & Control Considerations for Outsourced IT Operations Adnan Dakhwe, MS, CISA, CRISC, CRMA Safeway Inc. Core Competencies C32 CRISC CGEIT CISM CISA Introductions & Poll Organization has outsourced
NEW SCHEME FOR THE INFORMATION SECURITY MANAGEMENT WITH ISO 27001:2013
NEW SCHEME FOR THE INFORMATION SECURITY MANAGEMENT WITH ISO 27001:2013 INTRODUCTION The Organization s tendency to implement and certificate multiple Managements Systems that hold up and align theirs IT
Independent Accountants Report
KPMG LLP 345 Park Avenue New York, NY 10154-0102 Independent Accountants Report To the Management of Unisys Corporation: We have examined the assertion by the management of Unisys Corporation (Unisys)
Electronic Prescribing In New York State
Electronic Prescribing In New York State Joshua S. Vinciguerra, Director Bureau of Narcotic Enforcement October 28, 2015 October 28, 2015 2 Overview Review the problem & e-prescribing mandate Describe
The silver lining: Getting value and mitigating risk in cloud computing
The silver lining: Getting value and mitigating risk in cloud computing Frequently asked questions The cloud is here to stay. And given its decreased costs and increased business agility, organizations
Assessing & Managing IT Risks: Using ISACA's CobiT & Risk IT Frameworks
Assessing & Managing IT Risks: Using ISACA's CobiT & Risk IT Frameworks 2ο InfoCom Security Conference Anestis Demopoulos, Vice President ISACA Athens Chapter, & Senior Manager, Advisory Services, Ernst
The Elephant in the Room: What s the Buzz Around Cloud Computing?
The Elephant in the Room: What s the Buzz Around Cloud Computing? Warren W. Stippich, Jr. Partner and National Governance, Risk and Compliance Solution Leader Business Advisory Services Grant Thornton
Obtaining Quality Employee Benefit Plan Audit Services: The Request for Proposal and Auditor Evaluation Process
Obtaining Quality Employee Benefit Plan Audit Services: The Request for Proposal and Auditor Evaluation Process The AICPA Employee Benefit Plan Audit Quality Center has prepared this document to assist
HIPAA Compliance and Reporting Requirements
Healthcare IT Assurance Peace of Mind Through Privacy and Security Risk Management By Dan Schroeder, CPA, MBA, CISA, CIA, PCI QSA, CISM, CIPP/US Dan.schroeder@hawcpa.com BRIEF CONTENTS HCIT IMPROVES THE
www.pwc.com Third Party Risk Management 12 April 2012
www.pwc.com Third Party Risk Management 12 April 2012 Agenda 1. Introductions 2. Drivers of Increased Focus on Third Parties 3. Governance 4. Third Party Risks and Scope 5. Third Party Risk Profiling 6.
SSAE 16 & SAS 70 A Primer on Changes to Service Organization Audit Standards
A Member of OneBeacon Insurance Group SSAE 16 & SAS 70 A Primer on Changes to Service Organization Audit Standards Author: Jack Fletcher, Risk Control Technology Specialist Published: November 2014 Executive
E-PRESCRIBING OF CONTROLLED SUBSTANCES
E-PRESCRIBING OF CONTROLLED SUBSTANCES WELCOME Anthony Pudlo, PharmD, MBA, BCACP Vice President, Professional Affairs Iowa Pharmacy Association Outline of Today s 2/2/2 PRESENTER Ken Whittemore, Jr., R.Ph.,
G11 EFFECT OF PERVASIVE IS CONTROLS
IS AUDITING GUIDELINE G11 EFFECT OF PERVASIVE IS CONTROLS The specialised nature of information systems (IS) auditing and the skills necessary to perform such audits require standards that apply specifically
Chapter 04. Board of Public Accountancy.
Chapter 04. Board of Public Accountancy. (Words in boldface and underlined indicate language being added; words [CAPITALIZED AND BRACKETED] indicate language being deleted. Complete new sections are not
Vendor Management Compliance Top 10 Things Regulators Expect
Vendor Management Compliance Top 10 Things Regulators Expect Peter Davey, AAP VP & Director, Enterprise Payments, CapitalOne Pamela T. Rodriguez, AAP, CIA, CISA EVP, Risk Management & Education, EastPay
CHARTER OF THE AUDIT COMMITTEE OF THE BOARD OF DIRECTORS
CHARTER OF THE AUDIT COMMITTEE OF THE BOARD OF DIRECTORS PURPOSE The Audit Committee (the Audit Committee ) is appointed by the Board of Directors (the Board ) of NVIDIA Corporation, a Delaware corporation
SOC on Amazon Web Services (AWS) What You Need To Know Understanding the regulatory roadmap for SOC on AWS
SOC on Amazon Web Services (AWS) What You Need To Know Understanding the regulatory roadmap for SOC on AWS Jeff Cook November 2015 Summary Service Organization Control (SOC) reports (formerly SAS 70 or
E-Prescribing of Controlled Substances (EPCS) New York State Board for Podiatry
E-Prescribing of Controlled Substances (EPCS) As of March 27, 2015 it will be mandatory for practitioners, excluding veterinarians, to issue electronic prescriptions for controlled and non-controlled substances.
The Secure WebEx Meeting Experience
The Secure WebEx Meeting Experience presented by InterCall, a subsidiary of West Corporation, in partnership with WebEx Communications, Inc provides web conferencing services. Because these services are
HITRUST CSF Assurance Program
HITRUST CSF Assurance Program Simplifying the information protection of healthcare data 1 May 2015 2015 HITRUST LLC, Frisco, TX. All Rights Reserved Table of Contents Background CSF Assurance Program Overview
Navigating the transition to CSAE 3416
www.pwc.com/ca/controls Navigating the transition to CSAE 3416 FAQs on the new Canadian Standard on Assurance Engagements In response to changes in third-party assurance standards in both the US and internationally,
System Description of the Date Center System Relevant to Security and Availability (SOC 3) November 1, 2011 through April 30, 2012
System Description of the Date Center System Relevant to Security and Availability (SOC 3) November 1, 2011 through April 30, 2012 Moss Adams LLP 9665 Granite Ridge Drive, Suite 600 San Diego, CA 92123
G24: Audits of Controls at a Service Organization: New Standards SSAE 16 and ISAE 3402 Duff Donnelly and Jeffrey Spivack, Grant Thornton LLP
G24: Audits of Controls at a Service Organization: New Standards SSAE 16 and ISAE 3402 Duff Donnelly and Jeffrey Spivack, Grant Thornton LLP Audits of controls at a service organization Roadmap to the
Certified Information Systems Auditor (CISA)
Certified Information Systems Auditor (CISA) Course Introduction Course Introduction Module 01 - The Process of Auditing Information Systems Lesson 1: Management of the Audit Function Organization of the
SSAE 16 for Transportation & Logistics Companies. Chris Kradjan Kim Koch
SSAE 16 for Transportation & Logistics Companies Chris Kradjan Kim Koch 1 The material appearing in this presentation is for informational purposes only and should not be construed as advice of any kind,
Communications Between Predecessor and Successor Auditors
Communications Between Predecessor and Successor Auditors 1711 AU Section 315 Communications Between Predecessor and Successor Auditors (Supersedes SAS No. 7.) Source: SAS No. 84; SAS No. 93. Effective
Brown Smith Wallace, LLC
Brown Smith Wallace, LLC Successful Software Selection Whitepaper Series How to Adhere to Payment Card Industry Data Security Standards By Ron Schmittling, CPA/CITP, QSA, CISA, CIA To learn more about
UNITED STATES OF AMERICA FEDERAL TRADE COMMISSION
UNITED STATES OF AMERICA FEDERAL TRADE COMMISSION ) In the Matter of ) FILE NO. ) ACRAnet, INC., ) AGREEMENT CONTAINING a corporation. ) CONSENT ORDER ) ) The Federal Trade Commission ( Commission ) has
AUDIT OF SBA S EMAIL SYSTEM AUDIT REPORT NUMBER 4-42 SEPTEMBER 10, 2004
AUDIT OF SBA S EMAIL SYSTEM AUDIT REPORT NUMBER 4-42 SEPTEMBER 10, 2004 This report may contain proprietary information subject to the provisions of 18 USC 1905 and must not be released to the public or
Independent Service Auditor s Report
Independent Service Auditor s Report Microsoft Corporation Global Foundation Services Independent SOC 3 Report for the Security and Availability Trust Principle for Microsoft GFS 1 Independent Service
Orchestrating the New Paradigm Cloud Assurance
Orchestrating the New Paradigm Cloud Assurance Amsterdam 17 January 2012 John Hermans - Partner Current business challenges versus traditional IT Organizations are challenged with: Traditional IT seems
A Leading Firm. Services Audit Tax Business Advisory
A Leading Firm Dallas 14755 Preston Road Suite 320 P: 972-458-2296 F: 972-788-4943 Denver 1999 Broadway Suite 4000 Denver, CO 80202 P: 303-298-9600 F: 303-298-8118 Houston 500 Dallas Street Suite 2500
How To Pass An Assurance Course
FALL 2004 C.W. POST CAMPUS OF LONG ISLAND UNIVERSITY COLLEGE OF MANAGEMENT SCHOOL OF PROFESSONAL ACCOUNTANCY ACC 753 ADVANCED ASSURANCE SERVICES AND COMPUTER AUDITING Instructor: Joel Lanz, CPA, CISA,
ERIC M. WRIGHT, cpa, citp
ERIC M. WRIGHT, cpa, citp ERIC M. WRIGHT, CPA, CITP Eric has been involved with Information Technology with Schneider Downs since 1983. He specializes in and oversees the design, setup, installation and
Roles and Responsibilities Corporate Compliance and Internal Audit
Roles and Responsibilities and By Mark P. Ruppert, CPA, CIA, CISA, CHFP The focus group of Health Care Compliance Association (HCCA) and Association of Healthcare ors (AHIA) members continues to explore
eprescribing and EPCS
eprescribing and EPCS Prepared for the Nebraska Information Technology Commission March 6, 2014 Agenda Current eprescribing and EPCS environment Benefits of EPCS Overview of technology vendors What does
Questions from GAQC Conference Call The Impact of SAS 112 on Governmental Financial Statement Audits January 4, 2007
Questions from GAQC Conference Call The Impact of SAS 112 on Governmental Financial Statement Audits January 4, 2007 Preparing Financial Statements Q1. During a recent AICPA Webcast, a panelist indicated
Reporting on Pro Forma Financial Information
Reporting on Pro Forma Financial Information 1381 AT Section 401 Reporting on Pro Forma Financial Information Source: SSAE No. 10. Effective when the presentation of pro forma financial information is