ZenGRC

Simply Powerful GRC

Blog

Audit Performance Metrics: Measuring Internal Audit Performance

· ·

blue marker checking Audit Satisfactory selection on an audit checklist

While most companies attempt to secure their data, many continue to fail their IT audits. When trying to determine whether your risk management program effectively mitigates risks, you need to find metrics that support your ability to comply with internal policies as well as external industry standards and regulatory requirements.

Audit Performance Metrics

What are the Benefits of Metrics?

Metrics provide stakeholders objective input for determining resource allocations. For example, if an internal audit finds that the organization did not patch security updates in the 30-60 days, then the organization may need greater accountability or automated tools.

Moreover, mature cybersecurity programs often incorporate tracking mechanisms. These tools enable documentation and quantification to decrease the errors arising from manual reporting.

Why Incorporating Stakeholders Allows an Organization to set Internal Audit Metrics

Different stakeholders within the organization may define internal audit performance differently.

While the Board of Directors may be looking to eliminate reputational and financial risks, the c-suite may be seeking to build a tone of accountability. Meanwhile, the audit committee may want to use internal audit metrics to reduce external audit fees or protect from external auditor findings.

Thus, part of defining the metrics requires creating an audit team that includes internal stakeholders who communicate their different needs.

How Robust Internal Audit Policies and Procedures Define Audit Metrics

After creating an audit team, you need to put together a focused list of the needs and objectives that align across the organization.

For example, if you need to be PCI DSS, SOX, or HIPAA compliant, regulatory fines and penalties will be a crucial driver for all stakeholders, including the external auditor. On the other hand, your audit committee and c-suite may also want to reduce external audit costs by using the internal audit outcomes to streamline the more expensive process.

As with creating an audit plan, you need to start by prioritizing the metrics based on business objectives.

How to Use Audit Metrics to Mature your Compliance Program

Organizations increasingly add Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS) providers to enable business-critical operations. However, the cybersecurity risks inherent in these services can create business continuity risks that risk the financial bottom line.

Organizations that align their internal audit metrics to these integrated information security and business risks strengthen compliance and revenue outcomes. For example, operational risk now becomes an IT risk. Before computers, an employee accessing hard copies of sensitive information was an operational risk because it meant that the business did not follow its employee internal control procedures. Cloud migration now makes unauthorized access an IT risk as well as an operational risk.

What are Five Critical Internal Audit Program Metrics to Use?

How Satisfied Are the Internal Stakeholders?

Your internal stakeholders need insight into whether their risk mitigations strategies work. When designing the audit plan, you set a scope and objectives.

As part of the audit committee review, the internal stakeholders need to make sure that the audit met the scope and objectives. For example, if the organization added a new SaaS payroll application, then the internal audit needs to provide information proving the PCI DSS network segregation requirement is effective. This insight provides both the c-suite and Board assurance over internal IT controls and the financial risk mitigation strategy effectiveness.

What was the Financial Value of the Internal Audit?

Organizations using internal audits to reduce external audit costs need metrics that give insight. Comparing year-to-year costs is a starting point. However, some cost reductions may be less noticeable.

For example, managing vendor risk means gaining visibility into the organization’s third-party and fourth-party service providers. By engaging in an internal audit process that regularly monitors and documents the vendors’ control effectiveness, comparing it to the service level agreement (SLA), you can streamline the external audit process. Then, you can compare year-to-year the cost and time the external audit took.

How was the Performance Reported?

Although internal auditors segregated from the departments they review, human error often plays a factor in decreasing internal audit value.

Finding solutions that remove human error, therefore, can create better internal audit reporting metrics. A single internal auditor can only review a limited number of logs. However, an automated system that aggregates the reports and provides visual representations can allow your internal auditor to consider more information in less time. With more data comes greater assurance over the internal reporting that then reduces external auditor time.

What was the Audit Plan Coverage?

While the cost to complete an external audit may matter to the c-suite and Board, the audit plan coverage may be more likely to prevent data breaches.

Unfortunately, information security risk continuously evolves. Thus, traditional point-in-time audits may fail at providing full coverage. Using automated tools that provide continuous monitoring over the data environment allow an organization to provide greater coverage, mitigate more risks, and offer greater assurance over their IT control effectiveness.

How Rapidly were Issues Remediated?

If your company is using its internal audit function to lead to stronger external audit outcomes, then you need to find a way to streamline communications and speed up remediations.

Prioritizing remediation activities and communicating them can be a key metric when reviewing internal audit effectiveness. Internal communications can act as a barrier to remediation, which then undermines the goals of the internal audit function. The organization needs to prioritize and track issues so that it can work faster to remediate any problems.

How ZenGRC Enables Audit Metrics and Reporting

ZenGRC offers workflow tagging so that you can delegate audit tasks and monitor their progress and completion. Moreover, it allows you to prioritize tasks so that your team members know how to plan their activities.

ZenGRC’s workflow management capabilities include a centralized dashboard that continuously documents your control effectiveness making audit documentation easier.

Additionally, it helps you create an audit trail by documenting and remediation activities to support your responses to auditor questions.

When using internal audits to enable external audit processes and reduce time spent, using ZenGRC’s single source of information platform can speed up internal stakeholder communications and provide all documentation necessary thus reducing external auditor follow up requests.

For more information on how ZenGRC’s audit management workflows can streamline your process, contact us for a demo.

How to Improve Compliance in a Company

· ·

Highly regulated financial institutions often struggle with compliance management. As a financial institution matures its cybersecurity compliance program, the document management requirements often mean they need to find automated solutions that can create a single source of truth to ease audit stress. Financial institutions store, transmit, and process large amounts of nonpublic personally identifiable information, meaning cyber criminals more heavily target the industry.

As such, while all companies need to create mature cybersecurity compliance programs, the higher standard to regulators hold financial institutions means they need to improve their programs continuously.

7 Steps to Improving Your Company’s Compliance Program

Improving a company’s compliance, specifically for financial institutions, means revisiting and refining the original compliance program. Functionally, improving your compliance program means reiterating the process, drilling down into the original risk analysis, and integrating more specific documentation.

When attempting to mature your cybersecurity program, you need to start with the risk analysis first. Regulatory requirements and industry standards focus on risk-based models which means that if your risk analysis lacks specificity, your overall program will lack maturity.

From there, you need to continue the original process by focusing on details that may have been overlooked when you established your program. Unfortunately, given the dynamic nature of cybersecurity, you need to create a cycle of continuous monitoring, responding, remediating, mitigating, and documenting to provide assurance of governance.

Step 1: Engage in an Annual Risk Analysis

A risk analysis incorporates the risk identification, assessment, and analysis steps. Before you begin to improve your compliance program, you need to ensure that you know all the threats facing your financial institution. To do this effectively, you need to review all the locations where you store, transmit, and process data. This includes systems, networks, and devices. Then you need to review all the types of data you collect and store.

After this, you need to assess the risks to the different types of information and locations. Nonpublic, personally identifiable information is more attractive to cybercriminals so is a higher risk. The same true of things like software or networks that have commonly known vulnerabilities.

Finally, you need to analyze the risk a potential data breach by multiplying the likelihood of a data breach by the potential financial impact on the organization. This allows you to set the risk tolerances necessary for creating policies and mitigating risks.

Step 2: Update Policies at Least Annually

To mature the compliance program, you need documentation of the processes and procedures. Creating policies provides auditors the information they need to understand your internal control processes and align them with cybersecurity regulations. As your data needs change, you need to ensure that your policies reflect those changes.

Step 3: Continuously Monitor to Monitor Accountability

All industry standards and regulatory requirements focus on the importance of continuously monitoring your networks, systems, and software. Since cybercriminals continuously update their threat methodologies, the mitigating controls you set forth in your policies may no longer be adequate.

Step 4: Review Mitigating Controls

Mitigating controls protect you from cybercriminals while also providing assurance over your compliance program. As threats evolve, mitigating controls may need to evolve. As such, a regular review helps ensure that they align with the internal controls set forth in your policies to maintain a robust compliance program. By updating controls, you prove that you are following your response and remediation policy while also strengthening your compliance program.

Step 5: Engage in Continuous Response and Remediation

As new threats emerge, you need to respond and remediate them. As part of your continuous monitoring, you need to will find new risks to your data environment. However, detection is the first step. You need to make sure that you are continuously responding to and remediating any new risks that arise as part of your monitoring program.

Step 6: Continuously Document Program Improvement

Documentation provides assurance over your compliance with internal controls and external regulatory requirements. Documenting the risk process proves your program governance.

Step 7: Continuously Update Your Risk Profile

Since cybercriminals continuously evolve their methodologies and regulatory requirements cannot keep up with that, you need to maintain a strong compliance posture by continuously reviewing your systems and updating your risk profile as new threats emerge. Any time that you make a change to your systems, software, and networks, you need to review their potential impact and update your risk profile.

How ZenGRC Enables Companies to Improve Their Compliance Programs

ZenGRC provides a tracking system where organizations can log their compliance activities so that everyone knows what to do and when to do it so that you can more rapidly review the “to do” lists and “completed tasks” lists.

With our workflow tagging, you can monitor accountability and evaluate productivity over compliance program improvement by assigning tasks to the individuals in your organization responsible for the activities involved.

Finally, with our audit trail capabilities, you can establish a document management program that provides assurance over remediation activities to prove that you maintained data confidentiality, integrity, and availability as required by law.

For more information about how ZenGRC can streamline your GRC process, contact us for a demo today.

What is Vendor Risk Management?

· ·

As more organizations incorporate third-party service providers to increase business performance, vendor risk management (VRM) has become more important. IT suppliers such as cloud service providers and Software-as-a-Service products come with inherent risks that can lead to negative impacts. For example, a Distributed Denial of Services (DDoS) attack can lead to business disruption by shutting down the cloud service.

Most regulatory compliance initiatives need to consider formal vendor risk management policies and programs placing an emphasis on due diligence and subsequent vendor management. The third-party vendor review process follows the same steps as other risk assessments. Organizations need to list all vendors, review business criticality, identify information accessed, determine threats, assign a risk rating, analyze third-party risk, create a risk response, set controls to mitigate risks, and continuously monitor for changes.

However, vendor risk management has an additional planning step. Organizations need to use their risk assessments to define the terms and conditions of service level agreements (SLAs). SLAs are the contracts between the company and its vendor. To ensure vendors align with the established corporate risk tolerances, companies need to define the appropriate controls within the contract. Having the controls defined within the SLA allows the organization to set key performance indicators for maintaining the relationship.

What is the Difference between HIPAA and HiTrust?

· ·

The Health Insurance Portability and Availability Act (HIPAA) establishes a set of security controls that govern information security in the healthcare industry. Healthcare organizations and their business associates are legally required to protect certain types of patient information from data breaches. A HIPAA compliance violation can lead to fines and jail time, depending on how the protected health information (PHI) or electronic PHI (ePHI) disclosure or unauthorized access occurs.

The HIPAA Security Rule governs security standards regarding ePHI. Although the regulation does not prescribe controls, it details standards and regulations as guiding principles, including but not limited to COBIT, ISO, NIST, and PCI DSS. Thus, meeting these requirements can flummox healthcare organizations trying to establish controls to achieve compliance.

The Health Information Trust Alliance (HITRUST) established the HITRUST Common Security Framework (CSF) that assists companies attempting to meet the high HIPAA compliance standard. The HITRUST CSF aggregates all the suggested controls into a framework that makes it easier for an organization to be HIPAA compliant, although it is not part of the HIPAA regulation.

As a framework rather than a regulation, the HITRUST CSF creates a process that begins with establishing a risk management program that includes a self-assessment, asset inventory, risk assessment, risk analysis, risk tolerance considerations, risk mitigation process, and monitoring control effectiveness. HITRUST certification also requires the organization to undergo an external audit from a HITRUST CSF certified assessor. The CSF assessor reviews the risk management program and control monitoring to determine whether the organization appropriately completed the HITRUST assessment.

Although HITRUST CSF certification differs from HIPAA compliance, it allows an organization to create a more streamlined approach to meeting the Security Rule requirements.