Taming the audit request beast. Leticia Webb, CIA, CISA

Transcription

1 Taming the audit request beast Leticia Webb, CIA, CISA

2 But I need to go to work and run my own errands Bring me the remote Fluff my pillow I m hungry! Get my prescription

3 I need to take my meds There s no food in the house The bottle says I shouldn t drive I want to get water, but I can t seem to get up!

4 Process Owner Auditor

5 Sick Relative Know what you need and communicate as soon as possible Care Taker Leave a bottle of water, box of crackers and remote next to the bed Leave the prescription close by Go do your own stuff

6 Auditors Define your needs and communicate them Process Owners Work with auditors to get reports implemented Working with existing Business Intelligence efforts is a good place to start!

7 What is Business Intelligence (BI)? Dictionary.com The process of gathering information about a business or industry matter; a broad range of applications and technologies for gathering, storing, analyzing, and providing access to data to help make business decisions.

8 What can we do with BI? Leverage the company s process and technology investment to: Streamline audits Audits Perform analytical review Implement continuous/ automated auditing procedures Understand risk management efforts

9 Current state Desired state Defining success Succeeding

10 How long does it take to get what you need? Begin tracking when you send requests and when you get what you needed. What is the average turn around for your requests? Sample case study: After tracking a few audits, the rate was found to be 2-3 weeks on average from request to receipt of requested information.

11 How long should it take? Is it security sensitive? Are there already reports or repositories with the information you need? What would it take to provide you with access to the information?

12 What do you really want to get out of this? We want populations and we want them NOW! We want evidence and we want it NOW!

13 Getting what you need, when you need it. Developing a business case Working with process owners Working with data owners Working with report developers Getting the request prioritized and approved

14 Succeeding at taming the audit request beast

15 Reduce audit disruption Respond to external audit requests faster and more consistently Spend less time collecting data Spend less time figuring out what you got or telling external audit about what they got We got this report last year, why is the report different this year?

16 Why should process owners work with us? Often, we can use what they use which means we can provide validation for their data They spend less time dealing with us Collecting requested information Answering questions about requested information Trying to figure out what we want and why

17 When do you approach a process owner? A great time to approach a process owner during or after an audit, while the pain is still fresh in their minds More seasoned process owners (those frequently audited) may be open to the pre-audit approach

18 Why should data owners work with us? Where do you think the process owners go when they need to get something for us? We can also help validate their controls to publicize what a good job they are doing to departments that are still trying to run their own data marts

19 Why should report developers work with us? Report developers are often process or data owners in their own right It doesn t hurt that we don t complain about following change control procedures

20 Understanding the hurdles: We ARE taking time and resources away from other work Getting software licenses (if necessary) DOES cost money

21 Following the rules: Follow program development and change control procedures If procedures don t exist, don t be shy about talking to the developers about starting some Use existing tools like your help desk

22 Ensure the request: Includes data sources, attributes, filters and ACCESS RIGHTS Is supported by one or more key controls that are regularly tested Has support from the process owner, approval from the data owner and has been vetted by the report developer Explains the benefits of giving you your own report rather than getting someone to provide one every time you ask

23 Okay, everyone else gets something what s in it for me? Maintenance The reporting team will maintain the reports. If the underlying system changes you get to know and validate up front. Streamlined Audits No more waiting for what you need. Go get it. Friends in the Business The business now knows you understand their pain, and are willing to do something about it!

24 Questions?