Audit Management

ZenGRC v1.99 Release Features: Consolidated View of Internal Controls and Downloadable Reporting Dashboards Now Available

ZenGRC Team · March 11, 2016 ·

ZenGRC’s mission is to turn corporate compliance into a valuable strategic asset. The latest version of ZenGRC includes new capabilities designed to make it even easier for customers to track and manage their compliance programs. In v1.99 of ZenGRC, we are introducing a seed content registry that lists all available content for the standards and regulations that affect the majority of our customers. In addition, we are making reporting dashboards available for download via your user menu. This version also includes new email notifications that significantly reduce the amount of manual correspondence required to assign and track the progress of audit requests.

Consolidated Control Set

ZenGRC’s Seed Content Registry is a library of all available content for various standards and regulations that can be used within ZenGRC. It is now available via a link within your user menu, found in the top right corner of your instance. Every program can be easily imported into your instance. If you are interested in activating this content, please contact us at support@zengrc.com to schedule a consultation so that we can understand your goals and help configure the content to fit your needs.

Downloadable Reporting Dashboards

We continue to expand our reporting capabilities in order to provide you with executive level visibility into your compliance efforts. Our new reporting dashboards are Excel-based, which allows for easy cross-departmental communication on the progress of your system-of-record, audit activities, and other GRC-related activities. The latest version of ZenGRC makes it easier to create these dashboards and download them directly from inside your instance. Simply open your user menu to access a suite of dashboards, which include two pre-built reporting dashboards to provide visibility on onboarding and audit-related activities:

Onboard Progress dashboard: This dashboard tracks your progress in building a system-of-record. The dashboard tracks four vital metrics to help you understand how well you’re complying with a certain standard. It uses ZenGRC’s consolidated controls framework to reduce redundancies in collecting documentation and evidence for the same requirements.
Audit Project Management dashboard: The ZenGRC audit module allows you to collect evidence and test and assess controls. This dashboard provides executive-level audit visibility into which controls are performing effectively (and which are not) and the status of remediation for any issues, gaps or findings.

Our GRC experts can also help you build and configure custom reporting dashboards. Please contact ZenGRC a support@zengrc.com for a consultation.

Automated audit request notifications

Managing a document request list or PBC list is time- and labor-intensive. Our latest version of ZenGRC includes a new set of automated email notifications that alerts request assignees when they have been assigned to work on a request. This significantly reduces the number of manual emails that compliance managers need to send for audit requests. When an evidence request is assigned, ZenGRC automatically sends an email. If the request is overdue, both the request assignee and the requester (typically a manager) will receive a notification.

Feel free to contact us with questions about the new features available in ZenGRC v1.99.

Plum Release Features: Import Improvements, Downloadable Reports, Configurable Displays and More!

ZenGRC Team · November 4, 2015 ·

ZenGRC was created with the vision of revolutionizing compliance management. At the core of this vision is the belief that when managed properly, compliance can be an incredibly exciting and valuable strategic asset. At ZenGRC, we are hard at work, improving our product so that it is optimized for the needs of our customers.

Our latest release of ZenGRC, was driven by this optimization process and saw the introduction of several new features that will empower our users to better handle their compliance needs with ease. Below is a summary of these new features as well as explanations of their benefit to the user.

Import Revamp

Data-entry is a tedious task and we know that you have better things to be doing. In our Plum release, we’ve made a vast number of UX improvements to help you spend as little time on data import as possible. Let’s start with how we import.

New Feature: Any import activity (getting a template or importing a template) can be found universally in the top horizontal navigation.

Once you have gone to the import page, if you are in content-creation mode, here’s the experience:
On the left-side, you can upload a template ready for import. On the right-side, you can download templates.

Configuring Templates

New Feature: Import as many object types as you want on a single spreadsheet.
You can now tell ZenGRC to give you a single template with all of the object types that you’d like to import at the present time. Simply select the object types, and click to download the .csv file to open in Excel or Gsheet. If you’ve mis-clicked an object, simply click the trash-can icon to remove it from your template.

New Feature: Every object type allows batch .csv import.

Template Improvements

We’ve seen how easy it is to get to your import module and obtain the object-specific templates, now let’s take a look at improvements to the template itself.

New Feature: We now offer complete flexibility within import template functionality.

All object-object mappings are possible. Custom attributes appear on the template pre-populated. Objects can be batch unmapped and deleted. We’ve enhanced ZenGRC’s flexibility with regards to true many-to-many mappings. Our new universal and configurable import template allows you to designate any object in a “map: object” column header.

Flexible mapping

People make mistakes. We’re all human. Thankfully, the Plum import template also allows for bulk unmap. Simply use the template and designate a column header “unmap: Object”. Objects can also be batch deleted using a column header “Delete”.

Import Improvements

We’ve gotten our template set up easily, and now we’re ready to import.
We click the button:

and select our populated .csv file.
Let’s first look at an error-free, import attempt for System and Control objects:

All the mandatory attributes are populated. The codes are unique, and titles are there.

“Perfect” object import. Now we see:

Updating Objects

Re-importing objects with revised content has been greatly improved in Plum.

New Feature: The import review screen has been redesigned and provides far more detail on the status of your update import.

If you update just a few, but not all objects within a .csv, ZenGRC won’t give you any warnings. Just a simple tally of updated versus ignored objects.

If there are unreconcilable mistakes, such as 2 identical object codes, ZenGRC will still forgive you and import what it can. It will simply tell you what went wrong, but still proceed with updating all the other objects.

Downloadable Reports

With the new Data Export feature, you can download a report on any object (and update them with changes if needed). When downloading reports, you can use same templates that are used for imports. You can even export specific objects depending on their mapping with other objects in the system, and choose which attributes to export for each of the objects as well.

UX Wins

With the latest release of ZenGRC, we also implemented significant performance enhancements for the user.

Configurable Headers

In the world of governance, risk, and compliance, content and objects are plentiful. Simply looking at a large set of objects requires customizable lenses. In Plum, our macro view of long lists of objects improves in detail. First, we’ve supplemented our filter bar with configurable headers.

You can now select any stock or custom attributes to display in tree view.

The gear icon in the top right corner of any list of objects will pop open a modal to allow toggling in any 5 attributes of choice. The current limit is set at 5 attributes shown at a time, due to limited width across the screen.

Sortable Headers

In addition to configurable headers, ZenGRC parallels desktop computer functionality with sortable headers. Once your headers have been configured per the attributes you’d like to see, you can easily sort the entire list of objects alphanumerically with 1-click.

(sortable headers image)

Filter Mapped Objects in Tree View

If any objects are mapped to an object in your list, you can now also choose which mapped objects you’d like to see in the child tree modal, which pops up with the mapped objects icon. Unlimited child tree object types are permitted.

Common use cases for filtering the mapped objects include wanting to see a list of mapped company objects vs. standardized seed content objects (stock mappings for an authoritative source).

Redesigned Role Based Access Control (RBAC)

ZenGRC receives huge improvements in the logic and granularity of RBAC, or user authorizations. Global roles are more straightforward.

Global Roles
Every user falls into one of these roles:

- No Access – for off-boarded team members (allows you to maintain a full audit history)
- Creator – can create and edit their own objects, but can not see or edit any objects not owned by them (still have full ability to participate in workflows and audits)
- Reader – same capabilities as creator but can view all objects within ZenGRC instance
- Editor – same capabilities as reader but can edit any object in ZenGRC (still no access to admin dashboard)
- ZenGRC Admin – Superuser without any restrictions (exclusive access to admin dashboard where they can view the events log, edit program users and their authorizations, and edit custom attributes)

Program roles
To access program roles, open a program, then go to the People widget. Expand the person in question and then Edit Authorizations:

Program permissions are best way to organize access control within ZenGRC.

Performance enhancements

Backend refactoring
The relational model is re-imaged for mappings to make performance workable for data export and data grid. The impact – faster performance.

Faster visual loading times
Every tree in the app now uses lazy loading, which relieves apps performance. With all other features, like sortable headers, navigating to the desired object is faster and simpler.

Jira Integration (beta)
Our workflow module in ZenGRC is now synced with your JIRA instance. Create and manage workflows in ZenGRC and collaborate and execute tasks in JIRA. Tasks generated in ZenGRC will generate issues in JIRA. Task/Issue status changes, comments, labels, components will all sync bidirectionally.

You have the ability to choose which tasks within a workflow are synced with JIRA. With this new JIRA integration, your non-compliance team members will not necessarily be required to log into ZenGRC.

As this is a beta feature, we will be refining the functionality and adding additional customization options in the future.

Improved On-Prem Deployment process

ZenGRC now supports Docker, diminishing the time needed for on-prem technical administrators to both install and upgrade their ZenGRC instances. ZenGRC uses a private Docker repository on the official Docker Hub for images. A successful on-premise deployment will require a linux server installed with the Docker engine. Instructions to install Docker can be found at https://docs.docker.com/linux/step_one/.

Photo Credit: John Mcsporran

Top 3 Challenges When Updating Your Compliance Framework

Libby Bevin · October 7, 2015 ·

Well, it’s happened again. The framework you worked so hard to implement across your company needs updating. This typically occurs every 4-6 years to provide organizations with enough time to prepare. For example, Sarbanes-Oxley, GLBA/FFIC, FISMA, and HIPAA are frameworks associated with traditional computing. Traditional frameworks like these took a long time to update. Yet, in the last several years, frameworks covering new technology change every 2-3 years. Standards that cover cloud, mobile, encryption, and vendor management fit this new model. Thus, you will need to prepare to update your framework on an annual basis to keep up with all the changes.

Each change to your existing compliance framework will pose a challenge. First, you should understand the impact the changes will have on your audit program. Are the changes minor and only require rewriting controls? Are the changes in adding new controls that you need to anticipate?

Compliance specialists will have an advantage over most general compliance professionals. Specialists tend to focus on one or two standards only. They can spend more of their time focusing on a domain and know everything about it. Most organizations have many compliance needs and cannot just rely on specialists.

A compliance program should cover all aspects of compliance for an organization. It is best operated by a compliance professional that is able to manage company-wide compliance. Managing compliance requires someone who knows a lot about a lot of domains. It also requires someone who can rely on specialists. With each framework update, a compliance professional will need to approve the changes. Juggling the number of changes can be frustrating to manage. You should anticipate the challenges below and prepare for the inevitable changes to your compliance framework.

Challenge # 1 – Understanding the impact to your audit program

At first glance, updating your compliance framework may look like an exercise in copying and pasting the old text with the new text. This is rarely the case. Each compliance standard iteration will undergo a Q&A session by the compliance community. This will impact the interpretation of the new standard beyond the written controls. The impact to your audit program will require you to carefully review each change in detail. The reason this becomes so difficult is that your audit program may live in many places such as:

Many Excel spreadsheets with controls specific to a business unit/division
If the COSO/COBIT component was not updated, it will make it more difficult to apply the changes from the underlying domain.
Existing audit timeline with agreed scope, or signed contract mapped to the now older framework
Managing stakeholders, especially if their interpretations differ from the compliance team’s consensus

Many of these impacts can be better managed if you have a clear understanding of the net results in your audit program. If you can, use a tool that will evaluate each change and trace it through to your test plans, audit dependencies, and update the underlying data. Missing just a few updates can create unexpected audit gaps that can turn into audit findings. Although updating frameworks poses a risk to every audit, compliance professionals should be proactive. They should trace the changes and their impact.

Challenge # 2 – Updating the controls

If you store your controls in a central repository, you will be able to update the controls faster. Hunting down all the files across many locations will pose a bigger challenge. Every version of the file with your controls needs updating. Also, it can be common for updates to undergo updates too. You may need to go back and update the controls several times. As the compliance community implements the changes, they may find errors in it. This will produce more framework updates. Keeping a list of those changes and tracking version control is important. You want to update your controls across all instances.

Custom frameworks will pose more challenges. If you created a custom, best-of-breed framework that pulled from many domains, you will need to understand all the dependencies. If you used one domain as your foundation, you will need to trace those changes to all frameworks relying on that foundation. Each customization and each translation can magnify the amount of work. For example, any parent control or larger framework may need updating. That means that instead of just updating the controls within the new framework, you now need to update your internal inventory of controls that reference the new changes. For example, if you are updating controls form PCI 3.0 to PCI 3.1 that would be a somewhat straightforward update. But if your controls were built on SOC 2 or FedRAMP frameworks, you would have more to do. The changes to PCI 3.1 around vendor management, for example, may change the scope of your SOC 2. If you used FedRAMP, the area for key management would more attention. These granular impacts can add more work. That extra step becomes even more complicated when you use a COSO, or COBIT framework because they are not designed to be nimble.

Tracing the new changes and updating the controls will be an activity that will take at least 40 to 80 hours. Unless you have a tool. A tool can automate some of the menial tasks such as change control wording. It can also ensure all changes reach each instance where the controls live. It can also help in understanding the impact, such as before and after impacts. Without a tool to help, the changes will take longer to make and more likely to contain errors.

Challenge # 3 – Aligning your audit to the latest changes

Work with your external auditor, or assessor to understand the audit impacts. You should have a conversation early in the audit period. It would be ideal if you contact them at least 6 months before the start of their onsite activities. The reason for this is that you may need to prepare specific evidence that shows that you updated your framework. You may also need to add controls to your audit program that require a sample size of at least 6 months. The conversation should be straightforward because the external auditors will be fielding many of the same questions. They should also provide a specialist or a webinar where a specialist speaks to the changes. This way you will be better informed of the changes and have enough time to process them.

Ask the auditor to tell you about the challenges of other organizations. Learn from their mistakes where possible. Keep the dialogue open and apply what you learn so that you can prepare.

Conclusion

The reality is that new changes to frameworks will only increase in frequency. Technology and cyber risks are pushing the threshold of compliance frameworks. As attackers, breaches, and fraud methodologies evolve, the frameworks will need to adapt. Using a process and a tool that will help compliance professionals keep up with the changes will become even more important. Consider your solution and keep these challenges in mind when updating frameworks.

Photo Credit: John Mcsporran

A Perfect Nightmare: Compliance and Record Keeping Disaster Waiting to Happen

ZenGRC Team · September 16, 2015 ·

Most organizations begin their path towards compliance using the tools at their disposal. Tools help organizations start their compliance journey, but they can cause some problems. You should take into account these compliance pitfalls so that you can have a smoother compliance journey.

Pitfall #1 – Ensure everyone is working off of the latest version

The first thing that a compliance team will do is identify the controls to test. To test a control you need to provide evidence. Evidence comes in many forms such as screenshots, archived emails, or system configuration.

The list of controls that you compile for testing will evolve. For example, you may determine that some controls are “not applicable” and remove those. If you fail a specific control, you may need to add more controls to compensate. Control changes and evidence changes will make it difficult for everyone to stay synchronized.

Pitfall # 2 – Keep a simple method to track the evidence

Your first audit may lead you to believe that you will provide one piece of evidence for each control. This is true, but evidence usually applies to more than one control. For example, your IT Security Policy may apply to more than one control.

Every evidence gap carries a potential domino effect. Fail one evidence request and you may fail more than one control. It is important that you keep track of the evidence and the controls it impacts. It is important that you understand the mapping of each evidence to the controls it impacts.

Pitfall # 3 – Write down what you discussed

You will have many interviews during the compliance audit. The interviews will go over the controls with the individuals who perform them. For example, server security controls will include an interview with the server administrator.

Onboarding new employees will include an interview with the Human Resources team. Each interview will produce more evidence requests. You will need to write it all down and make sure you are proactive in tracking down the evidence. The evidence should fulfill the auditor’s requests. You should check with the auditor to ensure they receive what they requested. Your first compliance audit experiences will be more focused on answering interview questions. It can be difficult to also make a list of the evidence requests. But without the evidence, the audit will fail. This is why it is important that you keep notes and keep track of all requests.

Pitfall # 4 – Make sure everyone uses the same process

It is difficult to force everyone to use the same process. For example, storing evidence in the same location is difficult to do. If you create a common folder on the network drive, what do you do when someone does not use it? What is your backup plan when individuals begin to email the auditor instead? Keeping up with the paper trail can be the difference between passing, or failing an audit.

Conclusion

The pitfalls mentioned above occur in the majority of audits. When a company fails to avoid any of these potential problems, the result is a perfect nightmare. Record keeping is at the core of audits because both evidence and controls are records. An audit is about validating records. The records you track must be the latest version and you need to make sure you do not have any gaps. You are likely to fail your audit if you cannot provide all the requested records.

Also, people can create a bit of a mess when they begin to deviate from the standard process. You will improve your chances on your first audit by focusing on record keeping. Find a way to explain your process to others and focus on staying involved with all the audit steps. You can avoid the audit nightmare when you use record keeping best practices.

Photo Credit: John Mcsporran

ZenGRC has new audit functionality and redesigned emails!

ZenGRC Team · June 22, 2015 ·

In ZenGRC version 1.95.1.2, we’ve re-imagined the audit module with deeper, more practical functionality.

Keep track of test plans

We now allow you to assess controls based on their test plan, and create both requests and issues based off these investigations.

When creating and updating controls, you’ll notice a new stock attribute, called Test Plan. This field is important because it gets pulled into control assessment in Audit module when you are ready to create an Audit.

Remediate test plan results

If you open the Audit module and LHN (left hand navigation), you’ll notice 2 new objects:

Control assessments
Issues

Control assessments can be generated in an Audit based off in-scope controls that are mapped to any given program. “In-scope controls” simply mean the controls currently mapped to the program. Control assessments will generate and be mapped to each respective control. You can also create control assessments for cherry-picked individual controls in the Audit/control assessment tab, for any controls outside of the in-scope Program controls.
To generate control assessments for an audit based on your in-scope controls, just go to the In Scope Controls tab and click on the up-arrow to create your list of corresponding control assessments:

Each control assessment will be mapped to both a control and an audit. Depending on the control’s test plan, you’ll want to map other objects such as systems, policies and processes to the control assessment as well, to provide evidence for test findings.

Based on the results of your control assessment findings, you’ll then be able to indicate the effectiveness of the control, for both design and operation.

Track effectiveness of controls

There are 2 stock drop-down menu’s in each control assessment object to track your findings for the design of the test plan and the operational history of the control:

Create Issues and/or Requests

After you indicate the effectiveness of the control, you’ll now be able to not only create requests, but also issues.

Requests remain part of existing ZenGRC functionality. You can upload a PBC list to an audit to batch-generate a list of requests that show up in everyone’s dashboard.
Issues are new objects, and they can be created in 2 ways:

First, within an audit, issues can be created once the findings for a control assessment are documented. Within an audit, issues will always be automatically mapped to its respective control, audit, program and control assessment. An audit-generated issue will also pull the test plan from the mapped control.
Second, you can create issues independent of an audit. These issues can also double as incidents, as they don’t require mappings to a control assessment, program and audit. They can live in your system-of-record independent of those audit objects, and be mapped to workflows for issues tracking and management. They can also be mapped to other issues to show those dependencies.

Possible mappings relationship between new audit objects

An illustration of a mappings possibility with our new audit objects:

Usability improvements

Help modal for the object filter

Use the new these help tips to construct a boolean search. This will allow you to filter down a long list of objects in with more precision:

Ability to close the info panel

From left to right, you can minimize, restore, maximize, or close an object info panel.

Modernized emails

We now send email notifications with HTML design, instead of the simple text emails. This improves readability.