ZenGRC

Simply Powerful GRC

Audit Management

Segregation of Duties in IT: Ya Gotta Keep ‘Em Separated

· ·

Segregation of duties in IT security is one of the most basic ways to protect your environment. ISO/IEC 27001 requires separation of duties and responsibilities that potentially conflict. In doing this, your organization lowers the risk of both malicious and accidental modification or misuse. In addition, the standard incorporates these conflicting duties and areas as part of the ongoing risk assessment.

Why Segregation of Duties in IT Matters

The first reason businesses segregate duties is to prevent a conflict of interest, wrongful act, fraud, abuse, or error. The second reason is to make sure that any control failures are detected. If an employee is responsible for reporting on themselves or their superior, their fear of repercussion may impede them from fixing a faulty control.

At the most basic level, no single person should be able to change or destroy information without others noticing. However, you also have to make sure that all sensitive information is appropriately protected. Finally, the person who controls the design and implementation of IT controls needs to be different from the person who reports on how well those controls work.

Fundamentally, internal and external audit function as ways to incorporate segregation of duties. Since internal audit may have a vested interest in not reporting problems, external audits are the gatekeepers for internal audit.
While these multiple control layers can feel redundant or excessive, the financial risk and reputational cost associated with misused information can ruin your business. Keeping access and reporting segregated ensures ongoing compliance.

How to Segregate Job Functions

While businesses normally think of segregating duties in IT controls as a matter of software or hardware safety, the reality is that employees present the largest risk to most companies. Whether you do it purposefully or accidentally, segregating your employees’ access and duties within your organization is one of the best ways to protect your physical and technological assets.

As with any other controls you put in place, documentation of how you separate the different employee duties is key to compliance. To make sure that the appropriate employees have the correct access, you need to align job descriptions with software settings. To do this, you need to make sure that you have an effective user access review program in place.

In assigning access based on job function, you want to start by assessing risk. For example, if the same person who reviews time cards also has custody of paychecks, this poses a huge risk of fraud. Most businesses recognize this and separate those job roles.

What Steps Help Segregate Duties

Sometimes the types of duties clearly lend themselves to segregation from one another. Sometimes, however, the conflict of interest is embedded within the overall function.

Dividing the functions necessary to your organization acts as the first step. Once you have done this, you need to break down those functions into their discrete parts. Think about it like breaking apart a machine, comprised of many intricate gears that integrate to function fully. However, some gears are more vital than others for the machine’s efficiency. A weakness in one area can compromise the whole machine.
The same is true with companies. Breaking out your functions into their individual steps allows you to see points of potential abuse or weakness. Moreover, should a function be compromised, you can better track the source of the problem if you know the steps involved.

Once you determined the various points of potential weakness, you need to segregate the duties. There are several ways to do this. Authorization function requires two people to give approval for something. Documentation function requires that one person write down the function while another approves it. Custody of assets means that you put creation and storage of information in two different places. Reconciliation or audit means that one person takes inventory while the other reviews the work for completeness.

How GRC Automation Helps Track Controls Over Segregation of Duties in IT

When a single function can be broken down into multiple steps, tracking the controls can become frustrating. For a small organization, the functions might be easy to track because there are a limited number of employees.

Once an organization incorporates startup budget constraints, its management often chooses to organize these controls in spreadsheets. However, as the company expands and matures, so do the processes.

Being able to more efficiently map job descriptions to employee access means having stronger controls. Automation allows clearer visibility into how functions are separated into their parts and how those parts work to create a whole. By having a single source of truth, you can see all of your internal controls in one place and ensure that the appropriate segregations have been established.

How to Use Audit to Help with Segregation of Duties in IT

Traditionally, your CIO has handled reporting on the end testing controls. However, since the CIO oversees and designs implementation, they have a vested interest in the controls’ effectiveness. This is one of the reasons that having both a CISO and CIO matters.

Audit, however, has an interest only in testing the controls. This means that having an audit function automatically segregates duties over the controls. The question then becomes, why have an internal and external audit?

Your internal audit function is a self-assessment of your business. Pretend to be your internal auditor for a moment. Controls cost money. As the internal auditor, your job is to make sure those controls are appropriate. However, when you tell those in charge of the controls that problems exist, they get upset. Sometimes, the Board gets upset. Sometimes, the boss gets upset.

Though this is the internal auditor’s job, corporate culture can lead the internal auditor to prioritize protection of themselves or the departments with whom they work over robust information security. Perhaps they massage the message. If that happens, the report may technically note issues in the controls, but may do so in a way that makes it seem less important.

The potential for that conflict of interest means that external audit acts as balance to internal politics. Moreover, it acts as a check on internal audit’s capabilities. This shores up your compliance program. In many ways, this offers a segregation of duties that provides a check and balance similar to tripartite government.

You need both an external audit and or an internal auditor to monitor your controls most effectively. Your internal auditor helps monitor your organization with a sense of how your company works. They provide you with someone who knows your business and can continually monitor your controls. Your external auditor provides an entirely independent review unconnected to your company’s internal politics, offering insights that come from a fresh set of eyes.

How Using Automation Creates Better Audit Outcomes

Automation provides a single source of truth for audits. Internal audit needs to work with external audit to both create and disseminate documentation of your controls.
Internal audit contacts individuals to get documentation that supports the written segregation processes. However, this information gathering can be cumbersome. Multiple emails with various individuals can lead to ongoing communication problems.

GRC automation facilitates the scheduling of tracking and notifications. In addition, instead of having to spend time sifting through emails to track down responses, internal audit can review the submissions in one place. This single source of truth then provides the internal audit function with the appropriate documentation for external audit.

Streamlining the documentation process leads to greater cost savings when it comes to time spend on audit work. Internal audit can spend more time on the review process and focus more on the details of reconciliation. External audit can see more clearly into your organization’s compliance stance. All of this leads to stronger audit ratings and faster audits.

Auditing segregation of duties in IT helps keep your company free from fraud and creates greater security over your information assets. Using GRC automation to create a single source of truth for your audits provides a value add by lowering the amount of time spent on mundane administrative work.

For more information about how GRC automation offers efficiency and cost savings, watch our on-demand webinar, “6 Time Saving Steps to Simplifying Your GRC Strategy.”

Audit Mindset: Technology Drives Shift in Audit Values

· ·

Changing Technology, Changing the Audit Mindset

Audit Mindset

Technology is changing the audit mindset in much the same way that it has changed everything else in society. As auditors have more access to more data, they need to approach their audits with this in mind. In the past, companies used internal audit to check all processes and all policies. Using detailed testing, auditors checked off boxes while filtering through pages of documentation. As organizations have become more complex, internal auditors and the c-suite need to change their audit mindset to match the substantial increase in information.

Traditional Audit Mindset, Traditional Audit Values

 
Reading into the history of internal audit, the process initially started during the Industrial Revolution to help companies report and control costs. This created a backward looking, reactive process. Due to the nature of technology, audit became focused on reviewing current processes, finding problems, then telling companies to fix them.
 
These traditional audit values were outlined by Almutaz Bakry Sidahmed in 2015,

Traditional Audit focus on audit cycle (time duration, when last audit occurred), focus on deficiencies in controls, and cases of non-compliance with policies and procedure manual which may be outdated sometimes…. traditional auditing an understanding of Business Unit operations is built through time consuming process mapping exercises and might rely on outdated P&P manuals and audit staff spread all over the company trying to cover the audit universe which sometimes extend to more than one year

In the traditional audit mindset, auditors intended to review the company processes as a whole.  The goal of this would be to send in someone unaffiliated with the company to determine whether managers engaged in the most efficient and legal processes. This approach positions the auditor as an enemy by creating a divisive relationship of critique.

Managers manually collected all information for audit, spending hours seeking out the testing materials and aggregating records not integral to the business. As companies grew in size, analyzing policies and procedures between large organizations and small ones became untenable. The backward looking process fell out of favor with forward thinking regulators and trade associations over the last thirty years.

Transition to Risk-based Audit Mindset

Automation began making the traditional audit mindset and process inefficient. However, companies continued to use traditional audit methodologies due to early systems while retaining some of the original audit perspectives.  In 2012, the AICPA noted the need to change audit mindset in a white paper,

[A]uditors collect and analyze audit evidence and form opinions pertaining to internal controls as well as reliability of the information provided by management. At the engagement conclusion, auditors present a formal report expressing their opinion. In fact, this approach reflects the twentieth century methodology whereby there are high costs and significant time delays associated with information collection, processing, and reporting. … [B]asic CAATS (Computer-aided Audit Tools) contain capabilities to enhance audit effectiveness and efficiency. However, they do not operate on a 24/7 basis and therefore fail to construct a truly continuous auditing environment whereby exceptions and anomalies may be identified as they occur. Alternatively stated, they do not work with real-time or close to real-time data streams and, thus, are not able to address questionable events such as potential fraud or irregularities in an optimized fashion….With this in mind, one could argue that the traditional manual and retrospective audit is becoming an untenable position.

This risk-based focus then intended to streamline the process to focus on those business areas most prone to causing the company reputational, legal, or financial risk. Since the new systems began to address events in real time allowing for faster responses by companies thus further mitigating risks, the risk-based approach became more popular. The risk-based approach transitions the auditor from being an enemy to being a partner in business success. GRC automation makes this partnership easier and the risks more transparent. Be eliminating unnecessary reviews, organizations save time. Being about to map risks across multiple frameworks in a GRC tool offers the added benefit of times savings that correlates directly to money saved. 

The COSO Framework

When discussing risk management audit models, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the COSO ERM – Integrated Framework historically act as benchmarks. In 2013, COSO released an updated Internal Control -Integrated Framework. In the Executive Summary, they noted

Every entity faces a variety of risks from external and internal sources. Risk is defined as the possibility that an event will occur and adversely affect the achievement of objectives. Risk assessment involves a dynamic and iterative process for identifying and assessing risks to the achievement of objectives. Risks to the achievement of these objectives from across the entity are considered relative to established risk tolerances. Thus, risk assessment forms the basis for determining how risks will be managed.

A precondition to risk assessment is the establishment of objectives, linked at different levels of the entity. Management specifies objectives within categories relating to operations, reporting, and compliance with sufficient clarity to be able to identify and analyze risks to those objectives. Management also considers the suitability of the objectives for the entity. Risk assessment also requires management to consider the impact of possible changes in the external environment and within its own business model that may render internal controls ineffective.

With the implementation of this framework, COSO solidified risk as within the purview of both internal audit and the c-suite. Warren Stippich of Grant Thornton, LLC noted,

In adopting the new guidance for risk assessment and other Framework components, internal audit will ordinarily be responsible for the facilitation of the mapping of controls to principles. Implementing controls and remediating control weaknesses, however, will generally be the work of the CFO, the controller’s function and general counsel, and others such as internal audit. Boards and audit committees also have an important role to play in ensuring that any deficiencies in internal control noted by those charged with monitoring and reporting, including external bodies, are corrected. Overall responsibility, however, falls to management: It is their responsibility to ensure that the checks and balances in the organization exist for a sound system of internal control.

While the transition to COSO 2013 may take a great effort for some companies, the new guidance around risk assessment presents an opportunity to achieve important operational objectives. When implemented, the Framework can be more than just a compliance exercise — the requirements can help improve operational efficiencies and increase productivity.

Under this framework, management bears the responsibility for ensuring the ongoing strength of the organization’s controls. For many long time industry professionals, this new approach required some effort and buy in. Under this framework, management and the audit team need to work together to ensure productivity. Using an automated tool creates ease of collaboration. Lowering the time spent communicating means lowering the cost of compliance. 

The Risk-Based Audit Mindset and Profit 

Profitability creates buy in for the Board and c-suite. Risk-based audit models save time which increases profitability. By focusing on those areas whose noncompliance could cause the most damage to the company, risk-based audits lead to more focused results. Keeping in mind that audit originally intended to streamline business practices, the greater efficiency of risk-based audit makes historical sense. According to Jason Mefford, the writer of Risk Based Internal Auditing and writer of Risk Based Internal Audit Training, 

Risk based auditing is about focusing on those areas that stop an organization from meeting its key objectives instead of just looking at controls. Too often auditors are focused on testing low impact processes and controls, while ignoring a focus on key objectives. When auditors take a risk based approach, focusing on those forces and events most likely to impact an organization meeting its key objectives, that is when the provide the most value to their organizations, helping increase profitability.

Information technology audits under the risk-based audit mindset can provide the same types of corporate savings. Greater risk in the IT realm means loss of money or reputation due to a breach. Those costs are the same types of savings as a manufacturer identifying time saving processes in its labor stream.

Viewing the risk-based approach as a profitable exercise fosters a greater corporate culture of compliance. In addition, this transitions the audit mindset from conflict to camaraderie. When all audit parties view one another as financial assets, they cooperate more fully.  GRC tools help audit parties collaborate which in turn adds financial value to your organization’s compliance stance. 

Automating the risk-based Audit

Since audits no longer seek to test the entire organization, automating the compliance space when using the risk-based audit model makes the process even more efficient and profitable. By integrating risk control information with the the internal audit goals, the organization can stream line the execution of risk and compliance work. Further, by coordinating documentation in one shared space, critical evaluations and risk assessments will make creating the audit scope smoother. When the audit goes more smoothly, the profits increase. With this ease of access to information and documentation, the application of the risk-based audit approach becomes more appealing.

Shifting a mindset takes time and energy. People find change difficult and frustrating leading them to rely on old habits. However, automation can make the company’s audit mindset transition easier.  

If you want more information on how to use automation to help change your organization’s audit mindset, contact one of ZenGRC’s GRC specialists today.

SOC Audits: What They Are, and How to Survive Them

· ·

If you’re a service provider to public companies (or to any other organization that takes corporate compliance seriously) you’ll soon encounter the need for a SOC audit. Maybe a customer will ask for one; maybe your firm will volunteer to provide one to win a prospective client.

Regardless, SOC audits are now a routine part of the compliance toolkit. So let’s talk about how to assure that the SOC audit you undertake is fit for purpose.
First understand what a SOC audit is and what it does. “SOC” stands for “service organization controls”—so SOC audits are evaluations of the internal control at businesses that provide professional services. What kind of service firms? Any, really: law firms, consulting firms, outsourced IT providers, software vendors, payroll processors; the list is endless.

Conceptually, SOC audits are similar to the evaluation of internal control over financial reporting that a publicly traded company performs to comply with Section 404 of the Sarbanes-Oxley Act; or of cybersecurity controls to comply with data protection rules.

Public corporations, however, are also liable for the effective internal control—or the lack thereof—at service providers working within their extended enterprise. Remember the data breach that struck Target in 2014? It was caused by hackers first penetrating an HVAC vendor that managed Target’s ventilation systems, and then reaching Target through its online bill payments system.

SOC audits, often done by a service auditor, are a way to help larger companies assess the internal control of smaller vendors working with them.

The crucial detail is that corporations only need assurance over whatever specific risk a vendor poses to them—which can vary greatly from one corporation to the next, and one firm to the next. That led to the creation of several kinds of SOC audits, each one addressing different needs.

The Types of SOC Audits

The American Institute of Certified Public Accountants, which oversees questions like this, established three categories of SOC audits in 2011. What’s more, the first two categories each come in two types, for a total of five possible SOC audits a firm might undertake (and five reports those audits will generate).

SOC 1 Audit. A SOC 1 audit evaluates the controls at a professional services firm that are relevant to a client company’s internal controls over financial reporting (ICFR). In other words, this is the audit a public company wants to see as part of its compliance with the Sarbanes-Oxley Act. These audits are designed to meet the needs of companies who use service organizations (user entities) and the CPAs that audit user entities’ financial statements.

SOC 2 Audit. A SOC 2 audit gives the same treatment to a professional services firm’s data security and privacy controls. A client company might want to see a SOC 2 report as it manages its own PCI compliance (for credit card processing); HIPAA compliance (healthcare data); or broader data privacy rules such as the European Union’s General Data Protection Regulation (going into effect in May 2018). This makes SOC 2 reporting more important than ever.

Both audits also come in two types.

A Type I SOC audit only reviews how a firm describes its controls, and whether the design of those controls is suitable for the objectives that a public company has, as of some specified date.

A Type II audit examines the description and design of internal controls like a Type I audit, and also the operating effectiveness of those controls for a specified period.
That is, a Type I audit evaluates whether a service firm’s internal controls are designed to do what the firm’s management claims they will do, and whether those promises will serve a client company’s needs. A Type II audit also evaluates whether those controls actually work.

SOC 1 and 2 audits are specific attestation engagements: one public company evaluating the controls of one professional services firm. Therefore the AICPA restricts SOC 1 and 2 reports to only three parties: the “end user” reading the report, the audit firm compiling the report, and the services firm undertaking the report. (A vendor wouldn’t want a SOC 1 or 2 report floating around the public anyway, since the report would likely contain sensitive information.)

SOC 3 audit. A SOC 3 audit, in contrast, is available for public consumption. It examines privacy and data security controls like a SOC 2 audit, but isn’t as extensive. For example, a SOC 3 report doesn’t describe the tests an auditor performed on the firm’s controls. Nor does it examine controls related to ICFR, like a SOC 1 audit does. (Here is a nice SOC 3 example from Amazon Web Services.)

Because a services firm can commission a SOC 3 audit for itself, that means the firm has much more discretion to decide what will or won’t be included in the audit—and to keep the final report private if it paints an unflattering picture. The SOC 3 reports you see posted on a firm’s website are mostly for marketing efforts. (The AICPA even says: “can be used in a service organization’s marketing efforts.”)

A public company that takes internal control seriously will want to see a Type II audit, whether it’s SOC 1 or 2 and generate the SOC reports necessary. The company will also want that audit done by an audit firm registered with the Public Company Accounting Oversight Board.

Setting the Scope of a SOC Audit

This question can be tricky. As we mentioned, SOC 1 and 2 audits are intended for specific companies evaluating specific vendors. That means the scope of each audit varies, depending on what the end-user company wants to know about and what the vendor believes should be in scope to deliver that.

Ultimately the scope of the audit will be decided by your firm, your customer seeking the audit, and the audit firm performing it. Schellman & Co., an audit firm that performs SOC audits, recommends a few questions for all parties to ask themselves as you decide:

  • What service(s) do you need a SOC report for?
  • What systems are involved in providing those service(s)?
  • Are the services provided from a single location or several?
  • Is the report intended for all users or only one specific customer?

The first question will determine whether you need a SOC 1 audit (for ICFR) or SOC 2 (for data security). The last question will determine whether you need a SOC 3 (to be distributed widely).

SOC 2 audits deserve special attention since cloud services are proliferating so quickly, with data security risks growing right along with them. These audits evaluate a firm’s internal controls against a set of “Trust Services Principles” developed by the AICPA, and published as Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. How many principles are involved in your specific audit depends on the scope of the SOC 2 audit you want.

For example, if a firm only provides data storage, the SOC audit can be narrow: focusing on security and availability. On the other hand, if a firm stores and processes data (say, a medical claims processor or a CRM vendor), the SOC audit will need to examine the application and its processing integrity as well.

Setting the proper scope is a critical first step, that will dictate how much time, money, and work you spend on your SOC audit. David Lehmann, managing director of IT audit for Protiviti, has a much longer post describing how to prepare for a SOC audit and set the required scope. One key point he raises:

A thorough scoping should seek to determine for which TSP(s) customers will require assurance and which systems and components must be assessed to achieve the objective. A service organization can select any number and combination of TSPs for inclusion in the report, based on customer need and relevant contractual requirements.

Prepare for a SOC Audit

A firm can prepare for a SOC audit (of any kind) long before it actually undertakes one. The best way to do that is simply for the firm executives to ask themselves: what services will offer to customers? What regulatory risks will they face by using our services? And from those regulatory risks, what assurances will they require of us, so they can demonstrate compliance to their own auditors and regulators?

Those answers will lead to a review of your business processes. As Lehmann notes in his blog, that review will consist of a gap analysis, followed by remediation of control flaws and then testing; repeat as necessary.

A more specific set of recommendations comes from Sarah Morris at the audit firm Kirkpatrick Price. Any auditor that shows up to perform a SOC 2 audit, she says, will expect to see: (1) a risk assessment; (2) an annual review of policies and procedures; (3) an employee training program; (4) vendor management procedures (for any service firms you use); and (5) a business continuity & recovery plan.

The SOC Audit Itself

SOC audits unfold like any other and follow traditional auditing standards. First the audit firm sends an advance request for evidence it will want to see. Then the audit team will arrive at your offices to perform testing, conduct walk-throughs, and review documentation. The auditors will then document their results, and provide the SOC report to you.

How long can a SOC audit take? That depends. One good perspective on the question comes from Nicole Hemmer, a partner at Linford & Co., a firm in Denver that performs SOC audits. The on-site part of the audit should take roughly two weeks, she wrote on the firm’s blog, but:

The more control objectives included in the report generally means the longer the examination will take… For larger service organizations, or examinations that include a lot more control objectives, the testing could take place over multiple weeks.

Her point about the number of control objectives is an important one. It underlines the importance of setting a clear scope for the audit, so you (the service firm) know how much audit work is likely to happen.

Succeeding at a SOC Audit

The keys to a successful SOC audit are organization and documentation. That’s it, really. Auditors will want to see evidence, review documentation, and often talk to key employees. If you can provide all that quickly, the audit flows smoothly.

At least, that’s the idea at an abstract level. In the practical world, a vendor must study how it manages its internal control, and use technology wisely to put itself in the best position to survive an audit. That means…

Lose the spreadsheets. Spreadsheets are a terrible way to manage compliance. They can lead to duplicate data, lost data, conflicting data, or inaccurate data. (For a more thorough list of how spreadsheets can undermine effective internal control, GRC analyst Michael Rasmussen cited nine in a recent white paper, “Gaining Control Over end User Computing: Increased Pressure to Control Spreadsheets and Documents.”

Find a “single source of truth.” A single source of truth could be, for example, a data warehouse that stores all your policies, all data from any testing of controls you’ve done, and a matrix that shows which controls are assigned the risks your firm has identified. Achieving that single source of truth is what a GRC software tool tries to do.

Automate compliance processes. Certifications are a great example of this point. A firm could use manual processes: say, emailing business department heads every month, asking them to certify that all employees have access only to the data they need to see. Or the firm could automate certification: a GRC tool sends person-specific URLs so department heads can note their certifications, and compliance or security chiefs at the firm can then see where weak spots might be.

This Will Not Go Away

For all the complexity and variety of SOC audits (and we’ve barely scratched the surface of them in this post) the plain truth is that they will only grow more necessary in the future.

The cloud will let ever more service firms provide ever more services. Corporations will keep using more third parties. Pressure to govern that extended enterprise will keep growing. That means greater need of assurance over those vendor firms’ internal control—and more SOC audits. Prepare accordingly.

Jason Mefford Talks cRisk Academy and GRC

· ·

image: cRisk Academy

Based out of California, Jason Mefford is a well-known speaker on all things ethics, corporate governance, risk management, GRC, compliance and internal audit related. He has authored two books, Risk-Based Internal Auditing and Masters of Success.  He was also a contributing author on the OCEG GRC Capability Model v3.0. Mr. Mefford sat down with ZenGRC to discuss his new training platform, cRisk Academy, as well as changing an organization’s approach to risk.

ZenGRC: What’s interesting about cRisk Academy is that you bring with you both auditor and trainer experience. What was the catalyst for cRisk? How does your background uniquely situate the academy?

Mefford: I spent many years as both an external and internal auditor, was a Chief Audit Executive at two large companies, was responsible for information security, risk management, ethics & compliance, and have now been a trainer for many years. I understand the information that I needed to do my job better as an auditor, what I needed for the employees who worked for me, and now the needs of students I have in my courses.

Most people have a desire to understand risk better. Since the business context now changes rapidly, as a result of new technologies, it’s more important now than ever for individuals to understand how forces, events, and changes in condition impact their organization’s ability to meet their objectives. Companies that have been at the top of their industries now no longer exist, and some companies are now worth billions of dollars didn’t exist a few years ago.

Risk-based professionals need training to improve their professional competencies, but unfortunately many organizations have cut back on training budgets and often require professionals to “take vacation” in order to go to training. I also see a large demand for risk-based professionals outside the US wanting high-quality training. I spend most of my year traveling the world speaking and teaching, but I know I can’t reach everyone in person.

Also, as a trainer I personally wanted to provide a better option for authors. Many of the training companies and platforms do not pay authors enough to make a living, which I believe is very unfortunate. I realized there needed to be an option for students to get affordable training that they need, but also to fairly compensate expert authors. Since I couldn’t find one that existed, it seemed like the right thing to create one.

ZenGRC: What is your intended audience for cRisk? CISOs? CIOs? Auditors? Developers? Do you have any future plans to expand that audience?

Mefford: Our intended audience is anyone who considers themselves a risk-based professional and/or wants to “see” risk more clearly in their organization. That could be anyone in audit, risk management, governance, compliance, GRC, IT, etc… and even management. While many of our trainings are focused on helping practitioners do their jobs better, many of our courses are applicable to everyone in the organization, even the C-Suite.

We have an agreement with AuditNet® an online digital network where auditors share resources, tools, and experiences including audit work programs and other audit documentation. AuditNet® has been doing live webinars for many years and has a significant library of previously recorded webinars on internal audit topics. Our agreement allows us to publish the previously recorded AuditNet® webinars, and make the valuable learning available to auditors all over the world in an on-demand format. One of the problems with the webinar business has been once the webinar is over, the great content presented by experts is not longer available. We are happy to be able to provide a platform so auditors can now gain access to these previously recorded webinars from AuditNet®.
Many of the courses on our platform now are from AuditNet®, so they are specifically focused on improving internal audit practitioners skills.
We do have plans to add many more courses on corporate governance, risk management, ethics, and many more topics that are relevant to any risk-based professional.
 
ZenGRC: Talk to me about your platform. Since we’re all computer folks around here, what’s the difference between your platform and other training sites? Is this like a Netflix for webinars? Or an Amazon rental for webinars? 

Mefford: This is a great question and a great analogy to other entertainment platforms. Since my partner and co-founder has a background in the entertainment industry, we built our platform to match what people are used to doing with entertainment. We offer webinars, webinar replays, and on-demand training through our platform. Let me explain how it works using the entertainment analogy.

I personally have subscriptions to Netflix, Hulu, Amazon Prime, HBO Now, cable, and use Apple’s iTunes TV service. Most of those are subscription based, except for Apple. I pay monthly for the ability to watch movies and TV shows through those platforms whether I use the services or not. I don’t really like that option, especially my monthly cable subscription. I pay for cable so I have the ability to watch live sporting events, that are not available on one of the other platforms, but I also pay for many channels and programs that I don’t ever watch.

With cRisk Academy we wanted to provide an option that put the student in control of their schedule, and only have them pay for the content they want, without being locked into a subscription. I tend to find that even though I have several subscriptions, I am often left going back to Apple to find an on-demand option, so I have the flexibility to see what I want on my schedule.

I personally really enjoy the show “Game of Thrones,” and we can use that show to help illustrate how our platform works. “Game of Thrones” is an HBO original content program. If I want to watch the show I have a few options. I can watch it each week when a new episode is released on HBO. I can watch it through the HBO Now application. I can purchase it through Apple.

Since I travel often, it is difficult for me to watch the show at the appointed time each week. Watching at the appointed time is like attending a live webinar. It’s a lower investment, but I have to be available to consume the content at the appointed time, and I only get to watch it once.

Another thing about watching live TV is the commercials. Someone has to pay for the content. When we choose to watch live TV as a viewer we “pay” by having to watch the commercials from companies who are sponsoring the cost of the program. Most “free” webinars fall into the same category and require you to essentially watch a commercial from the organization sponsoring the webinar so you can watch for “free.”

We wanted a different approach where the student pays a small fee for the webinar, but receives hundreds of dollars in value from the presenter. Not only do the students get great content, to improve their career and help them do their job, but they also receive practical tools and special offers the presenter would normally charge their clients hundreds of dollars to receive.

If HBO offers reruns of the show, I could see when “Game of Thrones” was playing and watch a rerun. I would still have to schedule my time to be available for the rerun, but since there are usually several reruns, I would have more options.
This is like our webinar replays, only our platform allows students to select from several different time slots in the future, both during and after business hours, based on their time zone. No longer does one have to attend a webinar in the middle of the night.

Lastly, is the on-demand option. Since my schedule didn’t allow me to watch “Game of Thrones” live or as a rerun, I had the ability to purchase the entire season through Apple and watch it when and where I chose. Even though I have an HBO Now subscription, I am often blocked from using it when I am traveling internationally and can’t watch it on the airplane. For these reasons, I chose an on-demand option by purchasing the entire season through Apple. I paid more for the convenience, but then I could watch it when it was convenient for me. Another benefit, I can now watch the series as many times as I desire.

This is like our on-demand option. Once a student registers for the course, they can watch it when and where they like, as long as they have an internet connection. They can also watch and rewatch the training as many times as they want. All of the training remains in the student’s account forever.

Just like Apple, where I have the ability to purchase individual episodes or the entire season, we also offer the ability to register for individual 1-2 hour sessions, or get the entire “season” what we call bundles. You save when you purchase a bundle, just like you save when you get the whole season.

By offering training as webinars, webinar replays, and on-demand we are trying to provide students with flexible options to meet their schedule.
Image: cRisk Academy
ZenGRC:  From the perspective of a client, I love that these are individually priced. My state recently instituted a CLE requirement that makes it cost ineffective for me to retain ongoing licensing. Explain to me what the options are for individuals in my situation.

Mefford: Your experience reminds me of an experience from my own life. I had just moved to California and had just gone through the reciprocity process to get my California CPA license. I was already a licensed CPA in Idaho, but now that I had a license in two states I was hopeful my employer would support me in paying for my CPE training and licensing in both states.
When I approached my boss he said, “I know you spent a lot of time and effort getting your CPA. Most people who get it would hate to let it go.”
He was thinking exactly what I was thinking. I would hate to let any of my certificates or licenses lapse because of the time and effort I put into getting them. It’s unfortunate some companies are not supporting their employees now in their professional development. The employees really want to maintain them and shouldn’t let all that hard work go down the drain because of lacking CPE.

Luckily for me he was very supporting, and my company at that time and helped pay for my licenses and CPE training. Now that I am on my own, I pay thousands of dollars a year to maintain all of the certification, licensing, and CPE on my own. I do that because I worked so hard to obtain those certifications and licenses in the first place, that I don’t want to let them lapse.

As I mentioned before, many people who work for large organizations are asked to pay for it themselves. One reason for creating cRisk Academy is to help people have access to CPE at a much lower cost, on their time schedule.

We have also taken an approach to make our trainings available in smaller sizes (1 or 2 hours) and bundled into larger courses of multiple hours or days. This was a way to help students customize their learning experience so they only get what they need, and what they can afford, when they want it.

I remember a story from business school one of my professors told us about toothpaste. Toothpaste is something we use each day and don’t really think about. We buy large tubes and use it for weeks or months at a time. The story he told us was about how some consumer products companies that make toothpaste actually create special “one-time-use” packaging for certain parts of the world. It seemed odd to me at first until he explained they needed to do that because some people in the world can only afford to pay for a single serving of toothpaste. To them, brushing their teeth was a luxury they couldn’t afford everyday.

That story has stuck with me, and I guess one reason we do this is to help people that only need a “single” serving of training, instead of a full three-day course. It also is helpful for individuals who get to the end of their CPE year and see they are a few hours short. Now with cRisk Academy, they can purchase just the hours they need to maintain their CPE.
 
ZenGRC:  When looking at CLE requirements, many people think that having an “accredited” program is necessary. Is this true? How do you feel cRisk Academy can change that mindset?

Mefford: I’m going to let you in on a little secret that will probably make the accrediting companies mad.
One of the biggest accrediting companies in the US is the National Association of State Boards of Accountancy (NASBA). NASBA was created to help ensure Certified Public Accountants (CPAs) training is high quality and has reciprocity agreements with all of the state boards of accountancy. The idea is that if a training is NASBA accredited, it would be accepted by any state board of accountancy in the US for CPE purposes. For this reason, many people look specifically for NASBA accredited courses.

The reality is, only a handful of state boards of accountancy in the US require CPE to be NASBA accredited. I am personally a CPA in two different states and neither requires my CPE to be NASBA accredited. Each state does have their own CPE requirements, but those vary from state to state and are usually based on topic areas instead of accreditation.

Internationally NASBA accreditation is not relevant unless the student is a US CPA; and, as I already said, their state may not even require NASBA accreditation.
I have many different certifications and two CPA licenses. Only one of my certifications is particular about having accredited training, which means I am free to choose the training I need for the others, within the parameters of my certifications and licenses, to have most of my training qualify for my annual CPE requirements.

We decided not to go through the NASBA accreditation process, as it is very cumbersome and costly, especially in an online training format. We decided that since most people using our training platform wouldn’t require NASBA accreditation, there was no reason to add extra cost to our trainings when it wasn’t needed.

Our platform is perfect, for someone in your situation, who can’t afford the time away from work, or the large investment required to obtain in-person accredited training to maintain their certificates and licenses. It also allows you to customize your learning experience to get exactly what you need to do your job and meet your individual CPE needs.

One last comment on this area. It is important for people to focus on why we need to obtain CPE, not just obtaining CPE. Certifications and licenses mandate a certain number of CPE hours each year to help ensure professionals are staying relevant with changes and are competent to do their jobs. One’s focus should be obtaining the training they need to improve their career and do their job, not just getting CPE “hours.”

I think that is also one of the benefits of our training platform. Students can get the training they need to improve their career, and use the training for their CPE requirements. We offer CPE certificates for all of our courses once the course is completed, so students can track their training hours and use it in their CPE reporting each year.
 
ZenGRC: Your book really tries to get auditors to think differently, more holistically, about the way the audit process fits into the greater scope of business. Can you explain to me some of the ways in which you approach audit differently from others? Why do you feel this approach is better for an organization?

Mefford: The name of my book you are referring to is Risk-Based Internal Auditing. I used that title because lots of auditors realize they need to use a “risk-based” approach to auditing, but there are some misconceptions about what it really means to be risk-based in your audit approach.

What I advocate is “focusing on objectives, not internal controls.” I like to joke that an auditor never sees an internal control he/she didn’t want to audit. This causes many auditors to believe they need to test all of the controls in their organizations.

The real trick is to only audit key controls that relate to response activities their organizations are using to help meet key objectives. Auditors tend to focus first on controls instead of taking a couple of steps back and considering the organization’s objectives. As a result, they audit the details instead of looking at the bigger picture where they can provide more value to their organizations.
There are really three things that affect whether an organization achieves its objectives, which go back to the concept of Principled Performance®. Organizations are trying to reliably achieve objectives (performance) while addressing uncertainty (risk/reward) and acting with integrity (mandatory and voluntary compliance). Auditors should be focusing on the forces, events and changes in condition, that impact their organization’s ability to achieve objectives in those three areas. My book helps to explain how auditors can focus on the “significant” items.

The concept of Principled Performance®, created by OCEG, the organization that invented GRC, is really what my book is about. How auditors can help provide assurance to their board and management that the organization is on track to meet its objectives. This approach is better, since it focuses the auditor’s efforts on what matters most to the organization, not just what the auditor wants to, or thinks is important to audit.
This is a common theme I teach people in all of my trainings, including those on the cRisk Academy training platform.
 
ZenGRC:  One of the things we talk about constantly in infosec is building a culture of compliance and awareness. From what you’re telling me about your approach to audit and cRisk, it feels as though this is very much on your mind. How would you envision cRisk adding to culture shift within organizations?

Mefford: For organizations to succeed in the future they must be more risk aware. They must practice the concept of Principled Performance®. The risk-based professionals we are trying to reach through cRisk Academy need to clearly understand forces, events, and changes in conditions. They need to learn a language they can use to help others in their organization understand these concepts.

Culture in an organization is based on values and beliefs that lead to individual behaviors. The way to change culture is changing belief. Belief changes through education and experience.

If an organization wants to build a culture of compliance and awareness, their employees need to be educated (that’s where cRisk Academy comes in) and have experiences that support that culture.

Cultural change is a long-term process that requires repetition, another way cRisk Academy helps. Our on-demand trainings are available to the student as long as they maintain their account. They can go back and watch the video lectures again and again, until they really understand the concepts and can apply them in their job.

Cleanin’ Out My Closet: Software Not Shared Spreadsheets

· ·

Compliance theme with businessman holding a tablet computer

The devil of compliance is in the details meaning that implementing GRC software might be the perfect way to clean out those proverbial compliance closets. Many of businesses are turning towards automated systems because compliance focused spreadsheets are like the closet that has been accumulating out dated clothing since high school.

For Information Security teams, this kind of disorganization means a lack of audit trail and security. The comfort of spreadsheets, like a good bowl of chili during football Sunday, is an old tradition that can go by the wayside.

Michael Rasmussen, a self-proclaimed GRC Pundit, notes that page 124 of the report on JP Morgan’s London Whale incident was related to problems arising out of spreadsheet error, “the model operated through a series of Excel spreadsheets, which had to be completed manually, by a process of copying and pasting data from one spreadsheet to another.” In other words, the messy Excel spreadsheet process did do anyone any good. If JP Morgan’s troubles didn’t convince you, then maybe these other reasons might.

Shared Spreadsheets Are Not A GRC Platform

Many people believe that spreadsheets in shared corporate drives make it easier to coauthor documents thus eliminating the need for GRC software. Even though cloud storage services are becoming more prevalent, many companies still have that senior executive who has a hard time working in the cloud, and instead choose to download and upload from their desktop instead. This means that even though there may be a shared spreadsheet, version control is still an issue.

A GRC platform eliminates this inconsistency since edits and changes are automatically saved. GRC software also removes the ability for people to download and upload without incorporating the changes to what is documented on the system.

Lack Of History Is Lack of Audit Trail

Spreadsheets fail to provide an audit trail. Again, Google Sheets and other web-based servers seem to solve this by providing the option to view the “history” of the document. While this seems like a decent solution, all the view provides is a notification that someone made an edit. These views do not track the types or content of the edits reliably. GRC software continuously updates and archives documentation with no hassle.

Shared Spreadsheets Share Security Issues

Moreover, continued issues regarding access and security come with shared drive permissions. Shared drive folders have three settings. A person can view, comment, or edit. These options limit the ability to individualize employee permissions to match job and need. For example, not all individuals involved in a company’s information security protocol creation need to have editing rights. For some employees, viewing alone suffices.

You’re probably thinking, “This sounds like a Google Sheet might work.” However, what if a process impacts multiple departments. Determining who in that department should edit, view, or comment may become burdensome since it needs to be done on an individual employee basis. Adding new employees or removing employees can become a full-time job. GRC software permissions allow for individualization of permissions based on job type and employee need for access, on a per-user basis, and at scale.

Finally, when it comes to cloud-based servers such as Google Drives, the freedom to add them to private devices incorporates a new level of risk. With employees constantly working at home or on the go, many may connect their personal accounts to their work accounts to work efficiently. Viewed as harmless by the employee, company information may be compromised without their knowledge or intent. GRC software places greater security over the information with a hosted or on-premise servers.

Shared drive spreadsheets seem to be an innovation to help employees collaborate and keep records. Unfortunately, compliance and audit-related work requires a level of documentation and security that spreadsheets cannot provide. To meet the continued challenges facing the information security community, a GRC tool is the most effective solution.