ZenGRC

Simply Powerful GRC

Blog

Information Technology Risk Automation’s Benefits

· ·

supply chain compliance

Information technology risk management is the foundation for all compliance programs. Documenting risks and the controls that mitigate those risks takes time, effort, and attention. When the information technology risk are spread throughout the entire organization it becomes more difficult to access the right information. The consequence is that resources (time and money) are poorly deployed and your environment is less secure. GRC automation enables effective risk management, which leads to better compliance audit outcomes which ultimately leads to better financial and productivity outcomes valued by executive management and shareholders.

Information Technology Risk Automation and Risk Management

The first step to information technology risk automation is understanding the complexities of risk management in the context of your organization. Symantec’s white paper notes:

It is impossible to completely eliminate risk in today’s challenging IT environment. The best approach therefore is to adopt a risk-reduction strategy by implementing a solution that allows your organization to prioritize security and compliance efforts based on risk level. For example, by using an industry-standard risk scoring algorithm (Common Vulnerability Scoring System) you can assign an externally facing Web server or a PCI server a higher risk value than a print server so that deficiencies or problems on these high-risk assets are given priority status in terms of remediation efforts. You may even decide that to improve the overall security posture of your environment you need to have tighter configuration controls on these high risk assets.

For procedural controls, it should be possible to conduct risk-weighted surveys following the distribution of new policies and rate responses based on risk. Ultimately, your IT GRC solution should help you to focus on high-priority controls in order to meet risk and compliance goals on time, and within budget.

GRC tools can not only assess your risks but also show you where to focus your controls. This creates a safer, more efficient approach to information security. Mapping the information technology risk can allow your organization to better address them in your policies. Effectively addressing risks leads to better audit outcomes because your organization has engaged in meaningful review and documented that review for auditors to follow the company’s thought process. For organizations that use audit reports to build customer confidence, better audit outcomes lead to more revenue. 

Information Technology Risk Identification and Information Silos

Information technology risk identification can seem overwhelming for a company with multiple departments, with  different and conflicting processes. When it comes to information technology risk analysis, the problem of silos can add to your organization’s security concerns. David Strom from TechTarget says that when looking for a GRC tool, one of the most important questions to ask in terms of risk is:

Do you want a common framework for identifying risk across all your outward-facing enterprise applications? It may not be necessary if just one department is responsible for most of your response. On the other hand, if you have conflicting risk assessments being conducted by different departments, a common ground may be useful to speed up the questionnaires that are all part and parcel to these products.

Using a GRC tool creates a common language across multiple departments. Because everyone is now viewing compliance through the same lens, departments are more effective at reducing and mitigating information technology risk. Jason Mefford of Mefford Associates who also owns cRisk Academy adds:

One of the real benefits of having GRC tools in place at an organization is providing a common platform and language to use in the organization. Often the various groups involved have their own words to describe the risk assessment process. Having the common tool and language requires the individuals to use consistent terms and processes. Over time this helps to develop a positive culture that allows the groups to work better together…

…having a common GRC tool also allows better management oversight, and the ability to directly map the organization’s response activities to the underlying risks and other exposures they face. 

Information silos naturally create inefficiency which often lead to conflict or even noncompliance, both of which cost your organization money. Creating common ground synergizes compliance throughout the organization ensuring  both greater communication and consistency. In addition, by bringing together all the departments, automation of the information technology risk process creates a feedback loop that connects audit outcomes to risks. For example, a failed control mapped back to a risk gives feedback on the control’s impact. By removing this communication barrier, the GRC tool makes audit outcomes meaningful. Not only does the shared communication lead to a lowered chance of fines or risk, it also streamlines your workflow. Streamlining the workflow adds hours of productivity across the organization which translates into financial value. 

GRC Information Technology Risk Automation Tool and Culture of Compliance

Creating a culture of compliance not only strengthens audit outcomes but also provides long term protection of your assets. GRC tools play a critical role in creating this culture. Paddy McGovern, head of compliance content strategy for Interactive Compliance Training advises that one way to create a culture of compliance is to “[u]tilize innovative tools that promote maximum retention. If employees are bored, they won’t retain information. Instead, make use of the tools and systems available that will allow your employees to learn, and apply compliance policy like never before.”

Using a GRC tool is one way to promote maximum information retention. When you task employees with the evaluation of Information technology risk and then give them access to the policies that help promote the mitigation of those risks, they will be more likely to understand the integration of the two. Studies show that understanding is the key to retaining information.  By incorporating the appropriate employees into the information technology risk assessment process, the organization creates an overall sense of compliance ownership.

While IT departments want the ease of integration, senior managers care about the return on investment.  A culture of compliance needs to be driven by senior management. Using a GRC tool is an excellent way to create a powerful compliance culture.  When trying to sell the GRC tool’s cost to senior management, it’s important to discuss financial gain rather than compliance. An Ernst & Young white paper from 2015 identifies three areas of value a GRC tool provides companies:

  • Operational efficiency: By creating a common risk management approach, it is possible to potentially consolidate processes, remove redundancies and reduce duplication and effort. Through automation, manual intervention can also decrease.
  • Risk mitigation:If the level of risk is reduced in your organization,then it stands to reason that there will be less of it to manage. Audit costs and regulatory  fines can come down, as well as the cost of corrective actions, incident management, reporting and data manipulation. It is also possible to realize some indirect benefits such as lower insurance payments and cost of capital.
  • Business performance:With a more risk-savvy culture, decisions impacting investments, productivity, partnerships, mergers and acquisitions, and growth could all lead to better  financial performance. 

Since GRC tools reduce information technology risk with efficiency , they create a strong  financial incentive for the organization to adopt and employ.   The combination of financial incentives along with increased employee productivity should be compelling enough reasons to bring senior management to your corner.

A strong information technology risk analysis requires communication across the organization and employee participation. Using automated tools to enhance the efficiency provides senior management a scalable method for creating a top down culture of compliance.  Therefore, the importance of incorporating a GRC tool into your compliance landscape can be sold to senior management as being about the financial and productivity outcomes. This can help you succeed in obtaining those important compliance tools needed to do your job best and benefit the organization as a whole.

 

SOC Audits: What They Are, and How to Survive Them

· ·

If you’re a service provider to public companies (or to any other organization that takes corporate compliance seriously) you’ll soon encounter the need for a SOC audit. Maybe a customer will ask for one; maybe your firm will volunteer to provide one to win a prospective client.

Regardless, SOC audits are now a routine part of the compliance toolkit. So let’s talk about how to assure that the SOC audit you undertake is fit for purpose.
First understand what a SOC audit is and what it does. “SOC” stands for “service organization controls”—so SOC audits are evaluations of the internal control at businesses that provide professional services. What kind of service firms? Any, really: law firms, consulting firms, outsourced IT providers, software vendors, payroll processors; the list is endless.

Conceptually, SOC audits are similar to the evaluation of internal control over financial reporting that a publicly traded company performs to comply with Section 404 of the Sarbanes-Oxley Act; or of cybersecurity controls to comply with data protection rules.

Public corporations, however, are also liable for the effective internal control—or the lack thereof—at service providers working within their extended enterprise. Remember the data breach that struck Target in 2014? It was caused by hackers first penetrating an HVAC vendor that managed Target’s ventilation systems, and then reaching Target through its online bill payments system.

SOC audits, often done by a service auditor, are a way to help larger companies assess the internal control of smaller vendors working with them.

The crucial detail is that corporations only need assurance over whatever specific risk a vendor poses to them—which can vary greatly from one corporation to the next, and one firm to the next. That led to the creation of several kinds of SOC audits, each one addressing different needs.

The Types of SOC Audits

The American Institute of Certified Public Accountants, which oversees questions like this, established three categories of SOC audits in 2011. What’s more, the first two categories each come in two types, for a total of five possible SOC audits a firm might undertake (and five reports those audits will generate).

SOC 1 Audit. A SOC 1 audit evaluates the controls at a professional services firm that are relevant to a client company’s internal controls over financial reporting (ICFR). In other words, this is the audit a public company wants to see as part of its compliance with the Sarbanes-Oxley Act. These audits are designed to meet the needs of companies who use service organizations (user entities) and the CPAs that audit user entities’ financial statements.

SOC 2 Audit. A SOC 2 audit gives the same treatment to a professional services firm’s data security and privacy controls. A client company might want to see a SOC 2 report as it manages its own PCI compliance (for credit card processing); HIPAA compliance (healthcare data); or broader data privacy rules such as the European Union’s General Data Protection Regulation (going into effect in May 2018). This makes SOC 2 reporting more important than ever.

Both audits also come in two types.

A Type I SOC audit only reviews how a firm describes its controls, and whether the design of those controls is suitable for the objectives that a public company has, as of some specified date.

A Type II audit examines the description and design of internal controls like a Type I audit, and also the operating effectiveness of those controls for a specified period.
That is, a Type I audit evaluates whether a service firm’s internal controls are designed to do what the firm’s management claims they will do, and whether those promises will serve a client company’s needs. A Type II audit also evaluates whether those controls actually work.

SOC 1 and 2 audits are specific attestation engagements: one public company evaluating the controls of one professional services firm. Therefore the AICPA restricts SOC 1 and 2 reports to only three parties: the “end user” reading the report, the audit firm compiling the report, and the services firm undertaking the report. (A vendor wouldn’t want a SOC 1 or 2 report floating around the public anyway, since the report would likely contain sensitive information.)

SOC 3 audit. A SOC 3 audit, in contrast, is available for public consumption. It examines privacy and data security controls like a SOC 2 audit, but isn’t as extensive. For example, a SOC 3 report doesn’t describe the tests an auditor performed on the firm’s controls. Nor does it examine controls related to ICFR, like a SOC 1 audit does. (Here is a nice SOC 3 example from Amazon Web Services.)

Because a services firm can commission a SOC 3 audit for itself, that means the firm has much more discretion to decide what will or won’t be included in the audit—and to keep the final report private if it paints an unflattering picture. The SOC 3 reports you see posted on a firm’s website are mostly for marketing efforts. (The AICPA even says: “can be used in a service organization’s marketing efforts.”)

A public company that takes internal control seriously will want to see a Type II audit, whether it’s SOC 1 or 2 and generate the SOC reports necessary. The company will also want that audit done by an audit firm registered with the Public Company Accounting Oversight Board.

Setting the Scope of a SOC Audit

This question can be tricky. As we mentioned, SOC 1 and 2 audits are intended for specific companies evaluating specific vendors. That means the scope of each audit varies, depending on what the end-user company wants to know about and what the vendor believes should be in scope to deliver that.

Ultimately the scope of the audit will be decided by your firm, your customer seeking the audit, and the audit firm performing it. Schellman & Co., an audit firm that performs SOC audits, recommends a few questions for all parties to ask themselves as you decide:

  • What service(s) do you need a SOC report for?
  • What systems are involved in providing those service(s)?
  • Are the services provided from a single location or several?
  • Is the report intended for all users or only one specific customer?

The first question will determine whether you need a SOC 1 audit (for ICFR) or SOC 2 (for data security). The last question will determine whether you need a SOC 3 (to be distributed widely).

SOC 2 audits deserve special attention since cloud services are proliferating so quickly, with data security risks growing right along with them. These audits evaluate a firm’s internal controls against a set of “Trust Services Principles” developed by the AICPA, and published as Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. How many principles are involved in your specific audit depends on the scope of the SOC 2 audit you want.

For example, if a firm only provides data storage, the SOC audit can be narrow: focusing on security and availability. On the other hand, if a firm stores and processes data (say, a medical claims processor or a CRM vendor), the SOC audit will need to examine the application and its processing integrity as well.

Setting the proper scope is a critical first step, that will dictate how much time, money, and work you spend on your SOC audit. David Lehmann, managing director of IT audit for Protiviti, has a much longer post describing how to prepare for a SOC audit and set the required scope. One key point he raises:

A thorough scoping should seek to determine for which TSP(s) customers will require assurance and which systems and components must be assessed to achieve the objective. A service organization can select any number and combination of TSPs for inclusion in the report, based on customer need and relevant contractual requirements.

Prepare for a SOC Audit

A firm can prepare for a SOC audit (of any kind) long before it actually undertakes one. The best way to do that is simply for the firm executives to ask themselves: what services will offer to customers? What regulatory risks will they face by using our services? And from those regulatory risks, what assurances will they require of us, so they can demonstrate compliance to their own auditors and regulators?

Those answers will lead to a review of your business processes. As Lehmann notes in his blog, that review will consist of a gap analysis, followed by remediation of control flaws and then testing; repeat as necessary.

A more specific set of recommendations comes from Sarah Morris at the audit firm Kirkpatrick Price. Any auditor that shows up to perform a SOC 2 audit, she says, will expect to see: (1) a risk assessment; (2) an annual review of policies and procedures; (3) an employee training program; (4) vendor management procedures (for any service firms you use); and (5) a business continuity & recovery plan.

The SOC Audit Itself

SOC audits unfold like any other and follow traditional auditing standards. First the audit firm sends an advance request for evidence it will want to see. Then the audit team will arrive at your offices to perform testing, conduct walk-throughs, and review documentation. The auditors will then document their results, and provide the SOC report to you.

How long can a SOC audit take? That depends. One good perspective on the question comes from Nicole Hemmer, a partner at Linford & Co., a firm in Denver that performs SOC audits. The on-site part of the audit should take roughly two weeks, she wrote on the firm’s blog, but:

The more control objectives included in the report generally means the longer the examination will take… For larger service organizations, or examinations that include a lot more control objectives, the testing could take place over multiple weeks.

Her point about the number of control objectives is an important one. It underlines the importance of setting a clear scope for the audit, so you (the service firm) know how much audit work is likely to happen.

Succeeding at a SOC Audit

The keys to a successful SOC audit are organization and documentation. That’s it, really. Auditors will want to see evidence, review documentation, and often talk to key employees. If you can provide all that quickly, the audit flows smoothly.

At least, that’s the idea at an abstract level. In the practical world, a vendor must study how it manages its internal control, and use technology wisely to put itself in the best position to survive an audit. That means…

Lose the spreadsheets. Spreadsheets are a terrible way to manage compliance. They can lead to duplicate data, lost data, conflicting data, or inaccurate data. (For a more thorough list of how spreadsheets can undermine effective internal control, GRC analyst Michael Rasmussen cited nine in a recent white paper, “Gaining Control Over end User Computing: Increased Pressure to Control Spreadsheets and Documents.”

Find a “single source of truth.” A single source of truth could be, for example, a data warehouse that stores all your policies, all data from any testing of controls you’ve done, and a matrix that shows which controls are assigned the risks your firm has identified. Achieving that single source of truth is what a GRC software tool tries to do.

Automate compliance processes. Certifications are a great example of this point. A firm could use manual processes: say, emailing business department heads every month, asking them to certify that all employees have access only to the data they need to see. Or the firm could automate certification: a GRC tool sends person-specific URLs so department heads can note their certifications, and compliance or security chiefs at the firm can then see where weak spots might be.

This Will Not Go Away

For all the complexity and variety of SOC audits (and we’ve barely scratched the surface of them in this post) the plain truth is that they will only grow more necessary in the future.

The cloud will let ever more service firms provide ever more services. Corporations will keep using more third parties. Pressure to govern that extended enterprise will keep growing. That means greater need of assurance over those vendor firms’ internal control—and more SOC audits. Prepare accordingly.

Wednesday’s Women in Infosec: Michelle Schafer

· ·

Last month, we began a series of profiles of women in infosec to try to explore the different voices in the industry. This month’s profile focuses on Michelle Schafer one of the women in infosec profiled in our 119 Twitter Infosec Experts post.

Currently the senior vice president of security practice for Merritt Group, Ms. Schafer has over thirteen years of experience in the information security industry. After earning her bachelor’s degree in Communications from George Mason University, she worked in media relations for several organizations including PricewaterhouseCoopers. Over the course of the last thirteen years with Merritt Group, Ms. Schafer had become one of the leading voices of women in infosec.

Michelle Schafer, Sr. Vice President, Security Practice, Merritt Group
If you had to choose one event that led you to work in information security, what would it be and why?
Luck! I had been in technology for a few years, mainly focused on telecom and wireless, in a corporate communications role. After spending about a year and a half at an analyst firm, I wanted to try out agency life. Lucky for me, Merritt Group’s one opening for an Account Executive just happened to be in their growing Security Practice. I’ve grown my entire career here at Merritt and built something pretty unique with our dedicated Security Team.

Why do you like working in the information security environment?
What we do in the security field every day is meaningful and impactful. I believe that I’m making a difference in the fight against cyber criminals, even on the marketing side of things. My team has worked with over 70 cybersecurity companies over two decades to help build awareness for solutions that are helping to stop the bad guys. The threatscape is so much more pervasive now – impacting businesses and consumers everywhere – and it’s nice to see that people finally are starting to understand the problem.

If a n00b to the infosec world asked you for a piece of advice, what would it be?
Stick with it. Security threats are constantly evolving so you’ll never be bored in this field.

What is the most important issue facing professionals in the information security landscape today? Why?
We need more cyber warriors – both men and women – and we need them now. There is a dire shortage of information security pros and we need the next generation to step up and help us fight this never-ending battle.

What is the most important issue facing consumers in the information security landscape today? Why?
Consumers need to understand that protecting your own personal data is your own responsibility, not someone else’s. Data protection and privacy should become a way of life – from being mindful of what you post on social media channels to shredding your bank statements to using strong passwords and staying off public wi-fi – you must constantly be thinking about data compromise. Unfortunately for many, security doesn’t become real until it’s too late and your identity is stolen. We need to always be thinking about points of exposure in our daily lives.

What are your three “guilty pleasures” that have nothing to do with information security?
People who know me think of me as the “Starbucks Queen.” Yes, it’s true that I do love a good caramel macchiato! I also am completely sucked into watching The Bachelor series on ABC (yes, even Bachelor in Paradise!) – I probably shouldn’t admit that one! 🙂 Finally, most weekends you can find me in sitting on the bleachers, cheering on my kiddo at his baseball games. Being in infosec is awesome but being a mom is second to none!

How Digital Transformation Really Drives GRC

· ·

digital transformation

Like most technology startups, we welcome digital transformation of the business world. It opens new markets, lets you forge closer bonds to customers and business partners, increases profits, accelerates sales cycles. Wonderful stuff, and we mean that.

For compliance and risk professionals, however, the digital revolution brings challenges unlike any you’ve faced before.

The easy analysis is to say that all the benefits mentioned above also bring new risks—ones that can strike unexpectedly. New markets bring new corruption or money-laundering risks; new business partners bring new data security risks. That’s all true.
But unless you want to keep reacting to new risks, frantically whacking them down every time they crop up, compliance officers need to ponder this new risk and compliance landscape more deeply. What really changes during digital transformation? How can you build a sustainable compliance strategy in that world?
Well, we know that digital transformation changes two things at a company: the assets it owns, and the processes it uses.

For example, according to financial research firm Calcbench, intangible assets (intellectual property, trademarks, goodwill, and so forth) accounted for 9.6 percent of all assets on the balance sheets of the S&P 500 in 2011. Five years later, the figure was 11.15 percent—and that’s only for the large, stable businesses of the S&P 500. For younger, smaller firms, the percentage can be much higher.

That tells us that as this transformation continues, more of a company’s value will be determined by what it knows (data collection and analytics capability), and what others know about it (reputation). That’s a world apart from the value determined by the cash and goods a company possesses.

So if creating and preserving value is what the board worries about (pro tip: it is), then for risk and compliance managers, the future will be about how to help the company protect its proprietary knowledge and its reputation.
Easy enough so far. When we add the future of digital processes, however, the situation gets more tricky.

Visibility for All

On one level, digital processes are fantastic: they enhance that collection and analysis of data we mentioned above. Everything the company does can be labeled, logged, saved, retrieved, and analyzed, all at a moment’s notice.

On another level, however, that same advantage that digital processes bring—enhanced visibility into operations—can be turned against the company’s other objective of protecting value and reputation. Why? Because all the power of that enhanced transparency is available to anyone, inside the company or out, who knows the proper way to ask for it.

This is more than saying, “Don’t let hackers steal your data.” In today’s highly interconnected business world, with many third parties acting as part of your extended enterprise, the goal is to govern how your data is used. The strength of your governance processes will become enormously important.
For example, the ability to perform due diligence on third parties, and to produce that homework on demand, will be invaluable. Maybe regulators will want to see that work as they investigate a money-laundering rumor; maybe social media activists will want to see it as they talk up a human-trafficking scandal in your supply chain.

Regardless, success will hinge on your ability to demonstrate that your business processes are grounded in strong ethical values and that they work. If they work, your digital assets are protected; if they’re ethical, your reputation is protected.
One practical example of this is the Corporate Human Rights Benchmark, a project supported by institutional investors that takes data disclosed by large businesses (that is, transparency) and uses it to pressure those businesses into improving their conduct. Another is United Airlines: the company stumbled into a social media snafu recently when it barred two girls from boarding a flight while wearing leggings. That decision was in compliance with company policy (no leggings for people flying on United employee guest passes), but the ensuing outcry underlines the importance of clear policy, good judgment, and when to grant exceptions or stand firm.

Will surprises still come? Absolutely. But strong, effective GRC builds a company’s resiliency to weather the storm—and that will be the most important key to the success of all.

Information Silos Can Be Broken Using GRC Automation

· ·

View from above of two business teams working and interacting separated by border in office

Corporate information silos create compliance inefficiencies cost an organization money and time, but GRC tools can help break these system and information silos. Information isolation comes from broken systems, both human and electronic. When these human systems act independently, businesses repeat policies and processes that can lead to inconsistencies. Those inconsistencies can lead to compliance issues.

When computer systems act independently, security gaps can form. All of these lead to audit inefficiencies that cost a company money in terms of productivity. Those costs multiply when applied to compliance and audit because the information silos lead to confusion over responsibilities and accountability. That adds hours and cost to the audit process. Finding the right GRC tool to automate these communications breaks the silos by connecting people and systems.

GRC Automation Breaks Information Silos

What are information silos?

Information silos refers to either a management system that does not play nicely with other systems or an organization where information does not flow between departments. Whether discussing an information silo in terms of people or computers, the growth of the disconnect can be related to programming. Just like machines, people must be taught how to act in given situations. Corporations that encourage interdepartmental fiefdoms will find themselves facing this kind of disconnect.

What creates system information silos?

An IT organization is at a greater risk of silos than other organizations because there are two separate types of myopia that can affect the business.
The first type of isolated information would be technological, or within your company’s systems. According to Frankie Basso at Systemware, three catalysts to information silos exist.

  1. Legacy systems – Sure corporations want new and better systems, but all too often they park them next to the systems they already have. They are unwilling to give up legacy systems either because it is too difficult to migrate or there is really no reason to go through the expense and effort to move to another system. The current system provides the functionality the organization needs to do the job.

  2. Mergers and acquisitions – This can be the trickiest of all with the ramifications of organizations that suddenly find themselves with two ways – or more – to do seemingly everything. Oftentimes the best way for individuals to handle these sensitive situations is to ignore them. It works for individuals in the short term, but for organizations it’s an issue long term.

    Merger or not, each department inside an organization looks for a system or systems that address their specific requirements. When content in these different systems can’t be leveraged, time is wasted on repetitious tasks.

  3. Vendor diversity – In their understandable search for flexibility, corporations seek to diversify their vendor base. More solutions from more ECM providers creates more ways to capture, manage, store and access information. All those collaboration and information-sharing tools can end up adding layers of complexity.

With more vendors providing enterprise content management, businesses may be choosing different vendors to organize and store the documents and content about their strategies methods and tools. Organizations may be choosing vendors based on theirs products without thinking up front about the integration across multiple systems.

What creates interdepartmental information silos?

In addition, many organizations, information technology or not, suffer from interdepartmental silo mindsets. According to Brent Gleeson and Megan Rozo in a 2013 Forbes article,

The silo mindset does not appear accidentally nor is it a coincidence that most organizations struggle with interdepartmental turf wars. When we take a deeper look at the root cause of these issues, we find that often silos are the result of a conflicted leadership team.

Many executives may look at their organization and dismiss department inefficiencies and lack of cross-functional solutions with immature employees, lack of basic training, or simply the inability for some employees to play nicely with one another. Unfortunately, while these behaviors may be a result of the silo mentality; it is not the root cause. These assumptions will lead to long term harm to the organization by creating resentment and cynicism within the teams. Most employees become frustrated with their department and the organization when they have identified the problems, but can’t do anything about it. It is the responsibility of the leadership team to recognize this and rise above to create effective, long-term solutions that are scalable, executable, and realistic.

Although these two types of siloed information seem different, both stem from conflicting programming. In the case of the computer systems, that programming is in terms of code. In the case of the employees, that programming comes from management.

New technology seems exciting and shiny, just like new employees. However, anything new means replacing a pre-existing software or person. These kinds of legacies often lead to migration issues. When it comes to systems, it’s often easiest to just find a work around instead of taking on the expense of data migration. This means that when other systems in other areas are brought in, the legacies either don’t interact well or you are tied to your current vendor’s options.

The same can be said with management. People who have worked in a field for several years often find it difficult to change, thinking that “new” makes them “old” and outdated in the workforce. This inherent human fear leads to people not always being willing to share knowledge. In the same way, mergers and acquisitions only add to these rigid responses. Departments want to keep using the systems they know well, in the same way that managers want to keep using procedures they’ve always used. The sense of “if it ain’t broke don’t fix it” certainly helps to create information silos. While this may work in the short term, the lack of connection leads to long term problems.

How do information silos cost a company?

At the end of the day, the bottom line is what matters. Back in 2009, the University of Maryland’s researchers noted that poor communication in hospitals in the United States cost $12 billion a year which was approximately two percent of the nationwide hospital revenues and more than half of the average 3.6 percent hospital margin. IT and information security aren’t hospitals. Inefficient communication occurs in any industry, medical care just happens to have some numbers to support it.

Brittany Pay at eFileCabinet notes that, “silos can form when managers focus on individual departments, departments work in isolation, goals are kept on an individual department basis, or communication as a whole is not fostered and encouraged. Silos keep people from understanding what other departments and individuals are doing, effectively forcing everyone to work in a partial state of isolation.

The result of a silo in your business is a lack of productivity, poor morale on a company-wide scale, and, inevitably, poor financial performance.” When it comes to cost, the lack of communication can lead to gaps in work being completed which then requires additional time to figure out how to close those gaps. It also means that people’s expertise may be going to waste.

Similarly, systems that work in isolation and don’t connect with other systems create a disconnect in how work is done and how information is accessed. For example, if a payment system and a data storage system don’t play nicely together, it’s difficult for employees to share documentation to help support payment processing.

How do information silos specifically impact IT compliance?

IT compliance requirements often overlap across standards. Marne Gordon wrote in an article for CIO Update,

Although the goals of the multiple information security regulations may be different, there are six basic commonalities between the prevalent regulations, such as SOX, HIPAA, Payment Card Industry Data Security Standard (PCI), and ISO27001.

At first glance SOX and HIPAA do not seem to have much in common. HIPAA protects patient information, while SOX aims to reform corporate accounting practices and safeguard investors.

All of these mandates, however, require an incident response plan; a business continuity and disaster recovery plan; physical and logical controls over access to data; hiring, retention, and termination policies; and data backup and recovery procedures.

This means that when each of your departments is creating their own workflows, they are doubling, tripling, or even quadrupling the amount of time spent on the same tasks. This inefficiency costs the organization in several ways.
First, this lack of communication costs the overlap of time spent on the same task. Second, the different approaches are often reviewed separately meaning that more than one manager is reviewing the same item. Third, there is a cost associated with ensuring consistency between workgroups. Fourth, with so many people engaged in the same type of work, the person to whom questions should be directed is unclear. All of these costs impact your compliance.

How do silos impact IT audit?

The information silos impact your IT audits in all the same ways that they impact your compliance and more.
MIS TI Training Institute interviewed Michael Gallagher, managing director of CBIZ Risk and Advisory services, and shares.

“Companies are required to manage risk throughout the organization, by process and by sub-organization. The silos occur when that process isn’t coordinated across the company,” said Gallagher. “So each individual, officer, leader, department, or location decides on their own way to manage risk and their own priorities, and they may or may not be linked to anything related to the company’s strategic objectives. And that is a problem.”

According to Gallagher, there are some red flags to look for that could be indicators of an environment where risk silos are likely to occur. “Some of the signals are policies and procedures in organizations that differ greatly by location, process, leader, or executive,” he said. “Anytime you see schedules of authorization, levels of authorities, anything that is trying to determine approvals and authorizations and ways to talk about and quantify risk that aren’t tied to the company’s strategic objectives are clear indicators of silos in the organization.”

When too many people are involved in too many places, the risks are multiplied rather than mitigated. This can lead to poor audit results, which then leads to additional spending on compliance.

How do you break down information silos?

Kotter International noted in a Forbes article, that two ways to eliminate silos were to:

Bring the outside in: Make divisions share data with one another so people understand how each division is performing, what customer or external stakeholder complaints are, and where this room for improvement.

Create a “guiding coalition” that breaks down barriers: Bring together a team of people committed to changing the way the organization operates, composed of people from all levels, divisions and locations.

By bringing your organization together and finding people committed to communication, you can break down the silos to create greater efficiency. This sounds like it only takes care of the interpersonal silo; however, people create systems and update them. Paul Duvall, at IBM’s developerWorks blog, explains,

A cultural obstacle they often encounter is that traditional development and operations teams tend to work in silos, limiting the amount of inter-team communication until software release times. (And such communication is often confined to a series of tickets in an issue-tracking system.) Growing software enterprises must become more collaborative, or else they will cease to exist. The software industry is changing in this direction-much more quickly than some anticipated-as the result of cloud computing, which makes computing resources less scarce, and business demand. Companies that evolve will put those that don’t out of business.

As emphasized in the introductory article of this series, collaboration across organizational boundaries is one of the anchors of agile DevOps. This article discusses how establishing cross-functional teams and broadening the skill sets of delivery-team members are ways to increase collaboration and break down the traditional barriers that prevent software from being delivered continuously.

When developers from across an organization work together, software delivery becomes smooth and continuous. By creating agile DevOps, the organization can create systems that play better with one another.

How can GRC automation help break down silos?

GRC automation doesn’t create cleaner systems or remove employee turf wars. It does, however, create an atmosphere of integration. Spreadsheets are not the best way to approach GRC.

An automation platform, like ZenGRC, provides easy access to everyone involved in each compliance area. In the same way that DevOps needs to be collaborative so does compliance. By using an automation platform, the C-Suite sets the tone of collaboration.

Automation allows for you to see easily where there are overlaps in workflows so that you can apply the same protocols across the organization. The correct GRC automation system will allow you centralize evidence collection and assessments while also assigning roles to different members of the company.

By doing this, automation creates instant team collaboration and allows you to set up workflows that combine project management with compliance. In other words, automation is an elegant answer to creating efficiency.

Silos in information technology come in different forms. Despite the impact of system silos, you must keep in mind that people create those systems. Using automation as an elegant solution to create efficiency can add financial and moral value to your business.