Retail

Internal Control Practices to Prevent Inventory Loss

ZenGRC Team · September 21, 2024 ·

In 2020, more than 15 percent of U.S. retailers experienced inventory shrinkage — that is, loss of physical inventory — of 3 percent or more. According to the 2019 National Retail Security Survey, shrinkage cost the U.S. retail industry $50.6 billion that year.

A common cause of inventory shrinkage is larceny, defined as the taking of property without the use of force — indicating an inside job. One estimate from 2017 found that 33 percent of retail inventory shrinkage resulted from internal or employee theft.

Regardless of the cause, inventory shrinkage is problematic because lost inventory is corporate money gone down the drain: funds spent to acquire an asset, which then disappears so it can’t be sold.

Hence it’s vital to prevent (or at least reduce) inventory shrinkage. To do that, robust internal controls are critical.

The Impact of Inventory Shrinkage

Inventory shrinkage is a loss of inventory. It is the difference between the inventory recorded on a company’s balance sheet and the actual inventory stored and available for use.

Many factors can lead to such losses, including:

Vendor fraud or error;
Shoplifting or external theft;
Employee theft;
Administrative errors or improper documentation;
Damage.

Shrinkage cuts into profits. It is an especially serious risk in the retail industry and among small businesses that have to sell a large amount of products to make a profit.

To make up for physical inventory loss and the resulting decrease in profits, companies may need to increase the selling price of their products. That, however, can alienate customers and further exacerbate the harm to a company’s bottom line.

Shrinkage can also increase costs in other areas, such as investments in security technologies and personnel. These costs also hit the bottom line and may result in increased prices for customers.

Internal Controls for Inventory Shrinkage and Inventory Loss

Inventory shrinkage is unavoidable. The problem, however, can be reduced to an acceptable level where it doesn’t materially harm profits. For this, it’s crucial to identify absent or weak internal controls and implement robust internal controls to protect your business.

Segregate Duties

Segregation of duties means that different people are in charge of ordering, recording, reconciling, and safeguarding inventory. Dividing responsibilities in that way can minimize the chance of a particular employee stealing inventory stocks and covering up the theft.

Segregation of duties also assures that one employee’s actions are verified and approved by another. One employee may retrieve the stock for processing, while another counts the inventory and updates the records. It’s difficult for either one of them to steal inventory unless the two employees are scheming together.

Regular Inventory Counts

New inventory from a vendor must be immediately counted and reconciled with the packing list to confirm that there are no mismatches, clerical errors, or vendor fraud. If the amount is incorrect, the vendor must be notified immediately. It’s also essential to do a regular physical count of inventory levels to detect and address errors and fraudulent activities quickly.

Calculate and Compare Shrinkage Rates

In 2018, the median shrinkage rate in retail was 1 percent. Generally, an acceptable level of inventory shrinkage is less than 1 percent, but it depends on your industry. The rate itself can be calculated as follows:

Shrinkage Rate = (Recorded Inventory – Actual Inventory) / Recorded Inventory

Periodically calculating the shrinkage rate is an excellent way to monitor inventory and compare shrinkage rates throughout different periods. An unexpected increase in your shrinkage rate indicates that you need to investigate possible causes and take a look at your controls.

Rotate Duties and Job Assignments

Rotating job assignments is one way to prevent employees from engaging in long-term schemes to steal inventory. If one employee is stealing, the next employee assigned to their role may discover the theft and report it to the organization.

Mandatory vacations can also discourage theft because many dishonest schemes require the employee to attend to them daily. The scam may collapse or be detected if the employee is unable to execute it personally.

Implement Strong Security

Strong physical security measures can deter inventory shrinkage, particularly due to theft. For example, video cameras provide surveillance of inventory receiving areas and function as a visual recording system.

Other security measures to control inventory shrinkage include:

Restrict deliveries to loading docks;
Limit access to interior areas such as storage areas to authorized personnel only;
Segregate high-demand or expensive items in a separate storage area with more robust fencing, strong locks, and controlled access;
Establish a system to document and track any stock taken out of the storage area to another area.

Leverage Security Devices and Technologies

Item tracking devices, such as ink-blot tags and magnetic scanners, can deter and detect both internal and external theft. Barcode scanners make it difficult for internal users to steal inventory and alter company records to cover up the theft.

Digital information resources should also be secured with strong passwords or multi-factor authentication (MFA) to prevent theft and records alteration. Access should only be assigned to authorized personnel. Administrative or super-user access should be limited to assure only specific users can modify records for shipping, sales, purchasing, and inventory counts.

Set Up a Confidential Fraud Reporting Hotline

According to the 2018 Global Study on Occupational Fraud and Abuse by the Association of Certified Fraud Examiners (ACFE), more than 50 percent of corruption and fraud cases in organizations were detected by a tip.

Encouraging employees to participate in fraud detection and prevention can go a long way towards minimizing shrinkage. A confidential fraud reporting hotline allows employees safely to report any possible shrinkage events, such as theft, damage, clerical errors, or vendor fraud.

Make Shrinkage Prevention an Enterprise-Wide Initiative

Employee participation cannot happen without the support of the top leadership. The organization’s leaders, managers, and board of directors must demonstrate honesty, accountability, and ethical behavior from the top.

Leadership must demonstrate that good behavior (such as reporting larceny) will be rewarded; and undesirable behavior (such as participating in theft) will be punished. It’s also essential to set zero-tolerance company policies and adhere to them. Inconsistency will result in honest employees feeling demoralized, unappreciated, and potentially afraid of retaliation.

Set Par Levels and Reorder Points

Expired goods can result in inventory shrinkage too. To avoid shrinkage from expired goods, you must manage inventory turnover, rotate the stock, and prevent overstock.

A par level, or safety stock, is the amount of inventory that must be maintained between receiving shipments to meet customer demand. Setting the proper par levels can help the organization avoid stockout, overstock, and keep an eye on expiration dates.

Establish a Robust Documentation Process

It’s crucial that inventory is trackable and auditable. For this, timely, relevant, and up-to-date documentation is vital. All these documents must be part of the control environment to provide an audit trail and control inventory shrinkage:

Purchase requisition form. A written request from an employee to the purchasing department to purchase a particular item.
Purchase order. Sent by the purchasing department to a supplier requesting that the item be shipped.
Invoice. Sent by the supplier to the purchasing party requesting payment for items shipped.
Receiving report. Prepared by the receiving department, specifying the quantities and descriptions of items received from a supplier.

Adjust Accounting Records

All inventory-related documents should be regularly checked against accounting department records to confirm that there are no discrepancies (deliberate or accidental) between the inventory recorded and the inventory actually available.

If there is shrinkage, inventory losses should be recorded by increasing the shrinkage expense account and decreasing the inventory account. Accurate inventory shrinkage journal entries in the accounting system can help pinpoint errors and identify the steps required to address them.

Automate Inventory Record Keeping

Automating inventory and reporting is the best way for business owners to prevent inaccurate inventory records, malicious dishonesty, and theft. For this, comprehensive inventory management systems are available.

Such software can track the progress of inventory stocks, from the time it is acquired to when it moves into finished goods inventory. The system provides real-time and complete updates on inventory status and possible red flags.

Protect Your Inventory Better with Support from ZenGRC

You may not be able to eliminate shrinkage completely, but you can minimize it and protect your bottom line. This starts with the safeguards we have discussed here, as well as greater visibility into your risk environment.

Explore ZenGRC to get deeper, real-time insights into the risks affecting your inventory. Identify relevant risks across your business with the single, integrated experience offered by ZenGRC. See where risk is changing, stay ahead of evolving threats, and mitigate business exposure.

To see how ZenGRC can fit into your business, schedule a demo to get started.

What is PCI DSS certification?

Libby Bevin · November 28, 2023 ·

There is no PCI DSS certificate, per se, because credit card and cardholder data security—the focus of the Payment Card Industry Data Security Standard—is an ongoing process, not a one-and-done deal.

More prominent merchants, however, will need to attain a yearly Report on Compliance from a Qualified Security Assessor (QSA) or Internal Security Assessor. Under PCI DSS requirements, vendors processing 1 to 6 million or more credit card transactions per year and qualifying as Level 1 or 2 with significant credit card brands such as American Express, Visa, Mastercard, JCB, and Discover must attain this proof of PCI DSS compliance.

A yearly PCI compliance audit is necessary for any organization that processes large amounts of credit card data. Smaller merchants do not need a full-blown audit but can answer a self-assessment questionnaire.

Service providers to merchants and banks (known as “acquiring banks”) must also comply with PCI DSS. A service provider is an enterprise that processes, stores, or transmits cardholder data on behalf of another business or provides services that could affect cardholder data security. Examples include companies providing managed firewalls, intrusion detection systems, intrusion protection systems, data destruction services, and web hosting providers.

The compliance levels for service providers differ from merchant levels established by PCI DSS standards. The framework only requires a Report on Compliance for service providers processing 300,000 credit card transactions annually.

PCI DSS Certification vs. Compliance: What You Should Know

Understanding the distinction between PCI DSS compliance and certification is crucial for businesses within the payment card industry. While compliance ensures adherence to PCI DSS standards, certification involves an independent assessment by a Qualified Security Assessor (QSA) to validate compliance. This process, overseen by the PCI Security Standards Council (PCI SSC), verifies that your organization meets the stringent PCI DSS requirements set by payment brands.

The Payment Card Industry Data Security Standard (PCI DSS) comprises 281 requirements across 12 categories, which might seem overwhelming initially. However, it’s crucial to note that not all mandates apply universally to every organization. Determining your organization’s scope is the initial and pivotal step in preparing for associate QSA, CISA, Qualification Requirements, and PCI Data Security Standard assessments or audits. Key steps to consider include:

Scope Definition: Collaborate with a qualified QSA company to define the scope of your compliance efforts. This step ensures a focused approach to meeting PCI DSS QSA qualification Requirements relevant to your organization’s specific Cardholder Data Environment (CDE).
Network Isolation: Adjust firewall configurations to segregate the Cardholder Data Environment (CDE) from other networks, especially public ones. This helps enhance network security and compliance with PCI DSS QSA training course standards.
Security Measures: Implement robust cybersecurity and information systems security measures, such as up-to-date antivirus software, strong password policies meeting PCI DSS complexity QSA program Requirements, and using PCI SSC-approved secure systems and application security throughout your CDE.
Access Control: Restrict physical and digital access to cardholder data, ensuring only authorized QSA employee personnel have access. This minimizes the risk of data breaches and maintains compliance with PCI DSS.
Validation and Auditing: Regularly validate and assess compliance measures through PCI DSS assessments and security audits conducted by qualified QSAs. This process ensures ongoing adherence to PCI DSS qsa requalification standards and Requirements.

Who is a PCI QSA?

A PCI Qualified Security Assessor (QSA) is an accredited professional certified by the PCI Security Standards Council to evaluate an organization’s compliance with PCI DSS standards. QSAs, integral to the PCI DSS assessment process, conduct thorough security audits, assess cardholder data protection, and ensure adherence to PCI DSS requirements.

Do I need to hire a PCI QSA for certification?

Engaging a Qualified Security Assessor (QSA) for PCI DSS certification isn’t mandatory, but their expertise can significantly expedite the process. Their in-depth knowledge of PCI DSS requirements, gleaned through QSA training and accreditation, aids in streamlining security assessments, ensuring robust compliance, and addressing any cybersecurity vulnerabilities.

Finding a PCI QSA for PCI DSS

Selecting the right QSA company involves identifying accredited assessors with a proven track record in conducting PCI DSS assessments. Collaborating with a QSA who aligns with your organization’s needs and understands your industry’s nuances enhances the assessment process’s effectiveness and ensures comprehensive validation.

The PCI DSS Certification Process

PCI DSS certification involves multiple stages: assessment, remediation, and validation. Under the guidance of a Qualified Security Assessor (QSA), organizations address vulnerabilities, implement necessary security measures, and undergo on-site audits to produce a Report on Compliance (ROC) or a Self-Assessment Questionnaire (SAQ), validating adherence to PCI DSS requirements.

PCI DSS Certification’s Impact on Data Security

Obtaining PCI DSS certification ensures compliance and significantly enhances information security within an organization. The rigorous validation process conducted by QSAs strengthens network security, safeguards cardholder data, and mitigates cybersecurity risks, bolstering an organization’s reputation for stringent data protection and compliance with payment card industry standards.

Common Challenges and Solutions for PCI DSS Certification

Navigating the PCI DSS certification process presents challenges like resource constraints, evolving cybersecurity threats, and complex reporting requirements. Effective solutions involve robust security training, efficient risk management strategies, and compensating controls. Understanding and addressing these challenges ensures a smoother certification process and sustained compliance with PCI DSS standards.

Meet Your PCI DSS Compliance Goals with ZenGRC

Preparing for a PCI DSS audit can be cumbersome and costly, mainly when relying on spreadsheets. Fortunately, our robust tool is here to alleviate much of the workload, guide you seamlessly through the process, and ensure ongoing compliance between audits—experience worry-free, hassle-free compliance—the ZenGRC way.

What Are PCI DSS Standards?

Libby Bevin · October 31, 2023 ·

Everything you need to know about the Payment Card Industry Data Security Standard (PCI DSS) including its goals and requirements, and how your business or organization can achieve and maintain compliance.

Whether your organization is a start-up or a global enterprise, if you accept credit card payments, you must be compliant with the Payment Card Industry Data Security Standard (PCI DSS).

In this article we’ll take a closer look at PCI DSS, including its goals and requirements, and provide guidance on how your organization can achieve and maintain PCI DSS compliance.

What Is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations of all sizes that handle credit card transactions from major credit card companies. The security standard was created to increase controls around cardholder data to reduce credit card fraud. Although mandated by the card brands themselves, PCI DSS is actually administered by the Payment Card Industry Security Standards Council, an independent body created by Visa, American Express, MasterCard, Discover, and JCB.

PCI DSS provides comprehensive standards and supporting materials as well as support resources to help organizations assure the security of cardholder information. The security standard itself is the cornerstone of the Payment Card Industry Security Standards Council and provides the necessary framework for developing a complete payment card data security process that encompasses prevention, detection, and appropriate reaction to cybersecurity incidents such as a data breach.

Some of the tools and resources available with PCI DSS include:

Self-assessment questionnaires designed to help organizations validate their PCI DSS compliance.
PIN Transaction Security (PTS) requirements for device vendors and manufacturers, as well as a list of approved PIN transaction devices.
Payment Application Data Security Standard (PA-DSS) and a list of Validated Payment Applications to help software vendors and others develop secure payment applications.
A number of public resources, including:
- Lists of Qualified Security Assessors (QSAs)
- Payment Application Qualified Security Assessors (PA-QSAs)
- Approved Scanning Vendors (ASVs)
- Internal Security Assessor (ISA) education program

PCI DSS Standards: Goals

PCI DSS consists of 12 requirements for compliance, which are organized into six groups called “compliance objectives.” We’ll introduce the six PCI DSS goals and give a brief explanation along with the requirements for each. In the following section, we will discuss each of the 12 requirements in more depth.

You can also find complete information about each of these standards and requirements in our comprehensive guide, PCI Compliance Explained.

1. Build and Maintain a Secure Network and Systems

Before the age of digital transformation, criminals had to gain physical access to steal financial records. Today, the use of internet, e-commerce, and internet banking for the majority of financial transactions means that most PIN entry devices and computer networks are more at risk than ever before.

The first PCI DSS compliance objective, to build and maintain a secure network and systems, is primarily concerned with the need for a secure network. To achieve this goal, your organization should employ robust network security protocols and controls to prevent and deter any criminal activity. More specifically, your network security protocols should protect cardholder data from theft through any illegitimate virtual access of your payment system networks.

The requirements for this PCI DSS goal are:

Install and maintain a firewall configuration to protect cardholder data.
Do not use vendor-supplied defaults for system passwords and other security parameters.

2. Protect Cardholder Data

Cardholder data includes any information from a payment card that is printed, processed, transmitted or stored in any form. Any organizations accepting payment cards must protect cardholder data to prevent its unauthorized use, no matter where the cardholder data is stored – locally, or transmitted over an internal or public network to a remote server or service provider.

The requirements for this PCI DSS goal are:

Protect stored cardholder data.
Encrypt transmission of cardholder data over open public networks.

3. Maintain a Vulnerability Management Program

A robust vulnerability management program is a must for any organization, but particularly for those dealing in sensitive information. Vulnerability management is the systematic and continuous process of identifying weaknesses in your organization’s systems, and particularly in your business’s payment card system infrastructure. This includes security procedures, system design, implementation, or internal controls that could be exploited to breach your system security policy.

The requirements for this PCI DSS goal are:

Protect all systems against malware and regularly update antivirus software or programs.
Develop and maintain secure systems and applications.

4. Implement Strong Access Control Measures

Control measures are actions that can be taken to reduce the likelihood of a risk occurring. Access controls are designed to allow the effective management and control of sensitive data by permitting or denying access to the Primary Account Number (PAN) and other cardholder data such as credit card numbers. With access controls, any access must be granted only on a need-to-know basis.

Generally your organization can use two types of controls to protect itself from security incidents involving cardholder data: physical access controls and logical or technical access controls.

Physical access controls typically include all of the physical systems you use to manage, monitor, and restrict access to storage media, paper records, or system hardware. Most often, the term refers to physical security: the locks or other tangible mechanisms you use to protect sensitive information.

Logical access controls have more to do with the technology you use to protect your sensitive information. They are generally designed to limit the use of payment devices, computing devices, and wireless networks to authorized users only, as well as to control the access to any digital files which contain cardholder data.

The requirements for this PCI DSS goal are:

Restrict access to cardholder data by business need to know.
Identify and authenticate access to system components.
Restrict physical access to cardholder data.

5. Regularly Monitor and Test Networks

Your organization’s payment infrastructure comprises both the physical and wireless networks that connect all of your endpoints, devices, and servers. Ultimately, any weaknesses in your payment infrastructure can present the opportunity for a threat actor to gain illegitimate access to your payment cardholder data.

To prevent this type of security incident from occurring, you must regularly monitor and test your networks to find and remediate any vulnerabilities.

The requirements for this PCI DSS goal are:

Track and monitor all access to network resources and cardholder data.
Regularly test security systems and processes.

6. Maintain an Information Security Policy

An information security policy is a set of rules and guidelines that dictate how your organization’s information technology (IT) assets and resources should be used, managed, and protected. Generally speaking, your information security policy should apply to all of the users in your organization or its networks as well as to all digitally stored information under your control.

Simply creating an information security policy, however, is not enough. You also need to make sure that all of your employees understand the policy and the sensitive and confidential nature of cardholder data, as well as their responsibilities for protecting it. Your information security policy will set the tone for security affecting your entire organization, and will inform stakeholders and employees of their expected roles and duties related to the protection of cardholder data.

The requirement for this PCI DSS goal is:

Maintain an information security policy.

PCI DSS Standards: Requirements

The 12 high-level requirements of PCI-DSS are those bullet points listed above for each of the standard’s six primary goals. The requirements themselves have remained unchanged since its inception. Let’s examine them more closely to better understand their specific expectations.

1. Install and Maintain a Firewall Configuration to Protect Cardholder Data

A firewall works by inspecting incoming network traffic and assessing it against a pre-configured rule set, so the firewall can either allow or deny traffic to protect internal networks. To assure that your organization’s firewall is performing properly, you should assess and update your firewall configuration rules at least every six months.

To meet PCI DSS requirements, your firewall rules must be configured to restrict traffic to both servers and ports. Additionally, your servers and ports must be documented and necessary for business operations. You also must be able to justify any port or server left open as required for business needs.

2. Do Not Use Vendor-Supplied Defaults for System Passwords and Other Security Parameters

Manufacturer-supplied passwords are often easy for malicious actors, hackers, and cybercriminals to obtain. In many cases, the failure to change or disable standard passwords and accounts can lead to the exploitation of internal networks, resulting in compromised cardholder data.

To meet PCI DSS requirements, you must change all manufacturer settings for your wireless networks as well, including passphrases, passwords, and any other login credentials. You’ll need to delete any unsecured, undocumented, or unnecessary services to make sure that they can’t be used to gain access to your internal networks.

3. Protect Stored Cardholder Data

Regardless of PCI DSS compliance, your organization should strive to eliminate the storage of cardholder data, with the exception of data that’s necessary for business, legal, or regulatory needs. Following authorization, any Sensitive Authentication Data (SAD) must never be stored. This includes data on the magnetic stripe and CVV, EMV chip, and PIN/PIN Block.

Any cardholder data that is necessary to store must be rendered unreadable via encryption. This includes information such as the PAN, cardholder name, and expiration date.

4. Encrypt Transmission of Cardholder Data Over Open Public Networks

When using public networks for transmitting cardholder data, the data needs to be encrypted using strong cryptography. Whichever encryption method you select, it must feature a secure version and the appropriate level of encryption strength. Likewise, you should never use messaging applications such as chat, email or instant messaging to transmit PANs.

5. Protect All Systems Against Malware and Regularly Update Antivirus Software or Programs

To meet PCI DSS requirements, your organization must install, maintain and regularly update your antivirus software. You’ll also need to schedule periodic scans and generate appropriate audit records for all antivirus software, and restrict the ability to deactivate your antivirus software to management or authorized administrators. If you do need to disable your antivirus software, it should only be for a limited period of time.

6. Develop and Maintain Secure Systems and Applications

Any vulnerabilities identified during the vulnerability management process must be classified according to the level of risk they pose to your cardholder data environment. Vulnerabilities might include buffer overflows, cross-site request forgery, and cross-site scripting. Any public-facing web applications are also required to undergo testing via application penetration testing; so must application security tools or methods. Additionally, you must use Web Application Firewall to be PCI DSS compliant.

7. Restrict Access to Cardholder Data by Business Need to Know

Any role-based access should operate on the “need to know” notion. This means that an individual can only access the minimum amount of data necessary to perform his or her job. (Sometimes this is also referred to as the “principle of least privilege.”) Generally speaking, any access to your systems should be covered by this principle, which can be achieved by setting the default access to “deny all” users, with the exception of those who are expressly granted authorization.

8. Identify and Authenticate Access to System Components

To assure accountability for all actions taken on a system, you’ll need to make sure that users confirming their access are using a unique ID and robust passwords containing at least seven alphanumeric characters.

To meet this PCI DSS requirement, you also must employ multi-factor authentication (MFA) by using a secondary authentication in addition to a robust password. This can be done by sending a code to a device, using a biometric scan, or providing a key fob or smart card.

9. Restrict Physical Access to Cardholder Data

Physical access to secure areas within your cardholder data environment must be controlled and monitored by video or access control. All access data is required to be retained for 90 days, unless prohibited by law. When the requirement is no longer valid, cardholder data must be destroyed.

For example, paper forms with cardholder data must be shredded once the retention period has passed. Any point of interaction devices must also be listed, maintained and protected from tampering or unauthorized replacement.

10. Track and Monitor All Access to Network Resources and Cardholder Data

To connect specific actions to specific accounts and individuals, your organization must implement system logging. You are required to keep system logs for a minimum of one year, and have at least three months’ worth of logs readily available at all times. To avoid the alteration or deletion of system log information, you are required to backup your logs to a centralized server. You should also review logs daily to address any anomalies as soon as they occur.

11. Regularly Test Security Systems and Processes

You must perform penetration testing in conjunction with internal and external vulnerability scans to defend your payment cardholder environment from any network vulnerabilities. To do so, your organization is required to assure that your payment cardholder environment is routinely scanned for vulnerabilities, whether using manual or automated methods to identify any potential unauthorized access points. You should also employ file integrity monitoring and intrusion detection systems to identify and alert you to any unexpected changes in your environment.

12. Maintain an Information Security Policy

Your organization must develop and maintain an information security policy to meet this PCI DSS requirement. This policy should document the procedures and policies that relate to the security of your cardholder data, as well as a usage policy, which identifies which users can use which devices in which locations and for what purposes.

Similarly, your organization must also have an incident response plan in place. An incident response plan usually includes requirements for informing card brands, a business continuity plan, and data backup policies in case of a disruptive event. When notifying the public of a security incident, your organization should refer to the rules in your specific jurisdiction.

What Is PCI DSS Compliance?

PCI DSS compliance is a requirement for any organizations that accept, process, store or transmit credit card information. The goal of PCI DSS is to create a secure environment for such transactions to take place, starting at the point of sale. To meet PCI DSS requirements, all cardholder data must be stored on a private network that has no access or connection to the public internet.

PCI DSS compliance also requires merchants to hire a qualified security assessor (QSA), whose independent “attestation of compliance” assures that the merchant is compliant. The resulting compliance report should incorporate a review of the merchant’s security controls under the 12 requirements, including vulnerability management. Some merchants use approved scanning vendors (ASV) to manage their vulnerability scans.

PCI DSS non-compliance can lead to card data theft, fines, or even a bank’s refusal to allow a merchant or service provider to accept credit card or debit card payments. Understanding PCI DSS compliance is critical for your organization, and should be a top priority regardless of size or industry.

For tips on passing your PCI DSS audit with ease, check out Preparing for a PCI-DSS Audit: Five Steps to Success and our PCI DSS Audit Checklist.

What Are the Four Levels of PCI Compliance?

PCI DSS establishes four levels of PCI compliance regarding information security. Your organization’s PCI DSS compliance level depends on the number of debit card payments and credit card transactions you process per year, which credit cards you accept, and whether your enterprise has suffered a breach or cyberattack resulting in compromise of credit card or cardholder data.

The four merchant levels are:

Level 1: Merchants processing more than 6 million total credit card payments annually (across all channels), depending on which cards you accept.
- Typically includes larger entities.
- These organizations must meet the most stringent requirements for validating compliance. This includes passing an annual on-site audit by a Qualified Security Assessor (QSA) or an Internal Security Assessor.
- This compliance level also requires on-site audits every year, network vulnerability scans every 90 days, and for service providers, penetration tests and internal scans.
Level 2: Merchants processing 1 million to 6 million transactions annually.
- Typically includes mid-size and smaller enterprises.
- Although Level 2 merchants generally aren’t required to undergo an on-site audit by a QSA, in some instances, acquiring banks may require an audit and a report on compliance (ROC), especially for larger Level 2 merchants.
Level 3: Merchants processing 20,000 to 1 million transactions annually.
- Typically includes mid-size and smaller enterprises.
- Most of the time, these organizations can forgo an audit and instead complete a self-assessment questionnaire (SAQ) and file an Attestation of Compliance (AOC).
Level 4: Merchants processing fewer than 20,000 transactions annually.
- Typically includes mid-size and smaller enterprises.
- Most of the time, these organizations can forgo an audit and instead complete a self-assessment questionnaire (SAQ) and file an Attestation of Compliance (AOC).

Although an on-site audit by a QSA is only required for Level 1 merchants and service providers, many Level 2 and Level 3 entities also choose to comply with this requirement. Regardless of your merchant level, PCI DSS compliance will be an ongoing and continuous process.

To maintain these rigorous standards, you must be vigilant. The price of non-compliance with PCI DSS can be high, and in some cases, even crippling to your organization.

Meeting the 12 requirements and 281 sub-directives of PCI DSS can be overwhelming, especially if you’re using spreadsheets for your organization’s compliance management. Simply gathering all the documentation needed at audit time can be daunting, nevermind that your organization needs to stay current with the latest standards. Add to that the task of tracking vendor compliance and continually testing your controls and PCI DSS compliance can quickly become a seemingly impossible endeavor.

Fortunately, there are PCI DSS compliance solutions that can perform many of these tasks for you.

Maintain PCI DSS Compliance with ZenGRC

ZenGRC is a compliance and audit management solution that delivers a faster, easier, and smarter path to compliance by eliminating tedious manual processes, accelerating onboarding and keeping you up-to-date on the progress and effectiveness of your programs. With ZenGRC, your organization can get audit ready in less than 30 minutes – no coding or cumbersome imports required.

With expert-built preloaded content at your fingertips to make scoping, sending requests, and gathering evidence easier than ever, ZenGRC can help you reach your goals faster and keep your teams connected. Streamlined collaboration capabilities and automated workflows minimize manual task tracking and eliminate audit fatigue.

But ZenGRC doesn’t stop at maintaining compliance. It also helps you understand how your compliance activities are impacting your risk posture so you can effectively prioritize your investments. Now you can easily handle your compliance needs and take managing your IT risks to the next level.

With seamless integrations across the platform, ZenGRC gives you a unified, real-time view of risk and compliance, and the contextual insight needed to make smart, strategic business decisions that keep your organization secure and earn the trust of your customers, partners and employees.

Take your compliance to the next level with ZenGRC. Schedule a demo today.

IRM, ERM, and GRC: Is There a Difference?

ZenGRC Team · August 24, 2022 ·

The various niches of risk management have become a veritable alphabet soup of acronyms. The advent of the digital age is partly to blame.

Virtually every organization is “going digital” across multiple business processes and operations. For example, retail is now “e-tail,” manufacturing plants are increasingly automated, and nearly every step of the hiring and contracting process happens online, from application to background checks to payroll.

Every Internet-connected device on a corporate network exposes the organization to the risk that someone might breach the company’s IT systems. The danger increases that unauthorized parties – more commonly known as “attackers” – might gain access to private or proprietary information, cause a disruption of critical services, or shut your business down.

As such risks proliferate and evolve, so do the ways to manage them. New products, services, and consulting partners emerge constantly, each one striving to distinguish itself from the rest.

Coining new terminology is one way to do that. As a result, we now have:

Enterprise risk management (ERM)
Governance, risk management, and compliance (GRC)
Integrated risk management (IRM)

Exactly how do these approaches to risk management differ from one another? Nobody seems to know for sure.

Research firm Gartner, which coined the term “integrated risk management” in 2017, claims that GRC focuses narrowly on regulatory compliance, while IRM has a more expansive, risk-oriented view. Others disagree. (And where does ERM fit into that debate? Again, nobody is quite sure.)

What are the differences among these types of risk management? Are there differences at all? Which is best? This article will try to answer those questions.

ERM: A Short History

Not long ago, risk managers concerned themselves mainly with hazards such as fires and floods; or in the financial sector, loan defaults (credit risk). Organizations typically bought insurance to avoid the losses these risks could cause, thus “transferring” the risk to the insurance company.

Over time, however, boards and executives began to recognize that this vision of risk was too narrow in a global business world. Risks to the supply chain, risks of IT systems coming under attack, risks of regulatory enforcement distracting and disrupting senior executives: none of them neatly fit into pre-existing categories.

After a series of financial, accounting, and insider trading scandals rocked the corporate and shareholder world in the early 2000s, business leaders and Congress recognized the need for strategy-driven enterprise-wide risk management. As a result, in 2004, the Committee of Sponsoring Organizations (COSO) issued a second framework: Enterprise Risk Management -Integrated Framework, subsequently updated in 2017. COSO’s ERM framework builds upon, and is intended to work with, the committee’s internal control framework issued in 1992 and updated in 2013.

Today, COSO’s ERM framework and the International Organization for Standardization’s ISO 31000 Risk Management – Guidelines are the most commonly used frameworks for enterprise risk management.

GRC: A Short History

Although organizations have always engaged in governance, risk management, and compliance in one form or another, the term “GRC ” seems to have been coined by risk consultant Michael Rasmussen, the “GRC Pundit,” in 2002. Here’s how he tells the story:

“On a cold, snowy day in February 2002, in the offices of Giga Information Group in Chicago, soon to be acquired by Forrester Research, I sat through two vendor briefings that struck me with a revelation.

“The first was a technology vendor briefing demonstrating their solution to manage and integrate policies, controls, and risks. This struck me. It was something I had envisioned in the 1990s as a consultant, but I was not a software developer, so I never took action. It was simply brilliant. What do we call it?

“A few hours later, I had another briefing with PwC reviewing their services. My ADD mind was bouncing back to this previous briefing while returning to the PwC briefing – sort of a mental Ping-Pong. The PwC briefing had some terms that seemed to drift toward me from the sidelines.

“My mind locked onto the terms Governance, Risk Management, and Compliance on different slides. There it was! A name for this new market: GRC.”

Rasmussen notes that tech-driven GRC solutions came along years after organizations began using spreadsheets and documents (first as paper documents, and later in digital form) to track and manage policies, controls, risk registers, and risk assessments.

GRC solutions have rendered these manual processes increasingly obsolete, and make the job easier by performing ever-more functions. Rasmussen sees the GRC development timeline as follows:

GRC 1.0 (2002-2007): Financial reporting, Sarbanes-Oxley Act (SOX) compliance, and their related IT controls.
GRC 2.0 (2007-2012): Audit management, enterprise, and operational risk management, compliance beyond financial controls, and more.
GRC 3.0 (2013-2018): Using GRC solutions for enterprise-wide management in various areas such as risk management, compliance, legal, finance, audit, security, and health and safety.
GRC 4.0: (2018-present): Automated GRC.

IRM: A Short History

In 2018, the research and advisory firm Gartner introduced the term “integrated risk management” (IRM), defining it as “a set of practices and processes, supported by a risk-aware culture and enabling technologies, that improves decision making and performance through an integrated view of how well an organization manages its unique set of risks.”

It introduced the term as part of its “Magic Quadrant,” evaluating service vendors that provide IRM solutions. Previously, Gartner had focused on GRC vendors.
The firm strove to distinguish between IRM and GRC by saying that while GRC is compliance-focused and reactive, IRM is risk-focused and proactive.

Some thought leaders, including Rasmussen, disputed this distinction, pointing out that GRC solutions continually evolve as risks evolve. Moreover, he scoffed in 2018 at Gartner’s switch to IRM as a marketing-driven attempt to “make itself feel relevant” in The IRM Emperor (Gartner) Has No Clothes.

In 2020, Gartner informed vendors evaluated in the 2019 Magic Quadrant that it had retired the IRM market category “in favor of more targeted marketing segments.” While the company will continue to research IRM, it has found that most users view IRM as a strategy to be pursued rather than a product category, Gartner said. Its official statement is worth quoting at length:

“There is no single buying center for IRM solutions with a consolidated view of risk and a consolidated budget. Therefore, IRM is not a good fit for what our end user clients consider a ‘market’ to be. Magic Quadrants are aimed at individuals selecting vendors and products to solve specific critical problems. Therefore, this Magic Quadrant and Critical Capabilities research was not aligned to our end user clients’ behaviors.”

Does this mean that IRM is a risk management strategy and GRC is a risk management solution? Not so fast, our experts say.

ERM vs. GRC vs. IRM: What’s the Difference?

Practically speaking, there is no difference, according to ZenGRC consultant Gerard Scheitlin, founder and president of the risk management company RISQ Management. All three terms refer to enterprise-wide, integrated risk management – a program that encompasses all risks: cybersecurity, finance, human resources, audit, privacy, compliance, natural disasters, and so on.

The way the terms are used, however, defines ERM as involving strategic, high-level risk management that includes various functions and involves executives and the board.

IRM, according to Gartner, involves the hands-on work that makes ERM possible: the technical controls critical to effective cybersecurity, such as security monitoring, network monitoring, and perimeter protection.

Somewhere in the middle is system management: risk management policies and procedures, which Gartner places in the ERM camp. Accreditations and certifications are considered compliance; some of those measures fall on the ERM side (such as COSO and ISO 31000), while others would be more technically oriented and therefore classified under IRM (such as compliance with NIST and PCI DSS cybersecurity frameworks).

Under Gartner’s model, the place where ERM and IRM split is a gray area and irrelevant, Scheitlin maintains.

“The differences between them don’t matter,” he says. “They’re integrated.”
Both IRM and ERM provide a holistic model to manage IT risk and operational risk, Scheitlin says, and are integrally related. You can’t have one without the other: IRM feeds ERM, and ERM guides IRM.

And GRC, which Scheitlin calls “risk assurance,” implements this holistic approach. GRC is where risk management magic happens.

The Better Question To Ask

ERM, IRM, GRC: Which is more important? They’re all critical, Scheitlin says. The better question to ask is where your organization should start its risk management efforts.

“Typically, most start at the technical controls,” he says. “So you’ve got to have some in place. And that’s where every CISO wants to start, because it’s considered the first line of defense.”

“Then you’ve got to build out your system. How are you going to build it? What are you going to do? How are you going to put it all together? It would help if you built a model, like a risk hierarchy, to categorize how you will get work done. You have technical (IT) risks, system risks, and process risks. How will you ensure you’ve got the entire organization involved in this?”

For a truly holistic risk management plan, you need to create a risk profile for your enterprise that takes an integrated view of all departments and functions.

You’ll conduct a risk assessment identifying and prioritizing risks and establish the amount of risk you’re willing to take, typically known as your risk appetite.

You’ll think ahead, anticipating new risks down the road and your organization’s risk response: accept, avoid, transfer, mitigate.

You might use a risk management framework such as COSO or ISO 31000 to aid decision-making and guide you through these tasks. Risk management solutions (and especially GRC solutions) can also be invaluable.

The best GRC solutions will manage risks from bottom to top: technical, systems, and process, not only in the enterprise but also third- and fourth-party risks. They’ll also make compliance management a snap.

What Is IRM in Risk Management?

Integrated risk management (IRM) refers to all risk management practices used by an organization to enhance risk visibility and decision-making, so that the organization can not only survive risk, but also benefit from it.

IRM works by bringing discipline to how groups within the organization handle the risks they face; it is meant to impose unity and consistency across the many siloes of an organization that, left to themselves, might handle risks in different ways. IRM would make them confront questions such as:

How can we plan our actions to minimize risks?
What are integrated risk management’s value-creating factors?
What possible consequences may there be if the risk is not managed?
How can a comprehensive approach to risk management assist in minimizing failure and increasing success?

Building a solid IRM process inside a business has several benefits. Below is a summary of a few business benefits that an organized IRM program may provide.

Users and application systems receive accurate, consistent, and verifiable information.
It allows companies to meet compliance standards with readily available, trustworthy, and secure data.
It offers the flexibility to create and manage new organizational structures and inter-organizational linkages that may come from mergers and acquisitions.
The definition, implementation, and measurement of a corporate data quality strategy and metrics are made more accessible by integrated risk management, which also helps businesses prevent possible delays caused by data problems when providing services or goods to consumers.
It assists management in determining the best solution for managing risks following the organization’s strategy, objectives, and risk tolerance.
It aids leadership teams in maintaining a comprehensive understanding of how risks may affect the company’s business objectives and strategic goals.
It enables one or more risks to be managed by a single monitoring and management system, improving the clarity of corporate risk assessments, risk management, and understanding of interconnections between various risk categories.
IRM leads to a more realistic analysis and evaluation of managerial actions for risk mitigation by additionally taking into account events that occur beyond the researched risks alone.

Many Needs, One Solution

“ZenGRC covers all of this,” Scheitlin says. ZenGRC identifies vulnerabilities, analyzes policies and procedures, helps to assure that monitoring and other controls are working as they should, and strengthens compliance with various frameworks.

Features include:

Direct integrations with critical third-party apps. Select from our library of pre-built connectors via ZenGRC to integrate with the business and infosec apps your company relies upon, including AWS, Qualys, Jira, Splunk, Slack, and Tableau.
Industry-specific content developed by our experts. Access pre-built and preloaded templates for frameworks like SOC 1 and SOC 2, FedRAMP, ISO, PCI, HIPAA, and SOX, so your teams can get up and running fast.
Real-time access to infosec posture. Automate evidence collection, simplify workflows and generate real-time reports to reduce manual effort and shorten audit cycles.
Easy-to-use cross-mapping to multiple frameworks. Avoid redundancies, identify overlaps and quickly assess gaps in your company’s infosec and compliance efforts.
Customizable risk calculations and multi-variable scoring. Gain a holistic view of risk across your organization so you can understand how multiple risks interact, how they could affect your business, and the probability that they will become incidents.
Streamline vendor and third-party risk management. Automate questionnaires and assessments, improve vendor relationships, and eliminate unnecessary workloads for your teams.
Unified contextual insights based on your business objectives. Convey the risk implications of business processes and priorities to eliminate silos and enable data-driven decisions.
Increased visibility and reporting with dashboards. Improve transparency and multi-level stakeholder reporting with up-to-date status reports that aren’t a burden.

ZenGRC is the most comprehensive solution for fully integrated, holistic, enterprise-wide management of your organization’s risks. Schedule a demo today, and start on the path to worry-free governance, risk management, and compliance.

4 Risk Management Tips for Retail Business

ZenGRC Team · May 20, 2021 ·

Retail risk management is about much more than security cameras, mall cops, and theft insurance policies. COVID-19 lockdowns forced the retail industry to focus on its e-commerce operations, with sometimes drastic and quick changes to move as many transactions online as possible.

Such changes have considerable implications for good risk management. And some businesses that ignored those implications later paid a high price when attackers stole customers’ credit card information or wreaked havoc with store inventory.

In some ways, COVID-19 created the perfect circumstances for hackers and scammers. Online transactions mushroomed, generating a juicy target for hackers looking to purloin confidential data. Meanwhile, the rush to lockdown physical stores and expand online operations created all sorts of ways for businesses to overlook important safeguards they should have taken. And the attackers knew that.

According to Total Retail, these three types of cyberattacks against the retail industry are the most common:

DDoS (distributed denial of service). More than 20 percent of all attacks against online retailers are DDoS attacks that flood the computer server with requests for service and make it crash. Sometimes the cyberattacker will ask for a ransom to stop the attack. Paying, however, means you’re more likely to get attacked again in the future.
Payment card fraud. Another 20 percent of all attacks involve the use of fraudulent gift cards and credit cards. These attacks are popular with cybercriminals because they guarantee immediate gratification.
Inventory hoarding. This is considered a more sophisticated attack, and counts for roughly 15 percent of cyber attacks. A bot attacks the site and lists items as not available, even though they are in stock. This is also known as “inventory denia”l and can go on for quite some time before being detected.

Given that escalated threat landscape, now is a great time to develop an enterprise risk management (ERM) program to protect your customers’ data, that of your vendors and third-party contractors, as well as your own proprietary information and intellectual property.

Let’s take a look at how you can best do so.

Identify and Assess Your Cybersecurity Risks

You can’t fix something if you don’t know where it’s broken, so the first step is always to assess and analyze: take a detailed look at your cybersecurity risks.

Here’s a checklist to get you thinking:

Are your security system, internal cameras, or even the store thermostat connected to an application and accessible from anywhere? Cloud-first solutions are common, and can be hacked to allow access to your physical store or inventory warehouse.
Who handles your point-of-sale data? Any vendor and subcontractor you interact with on a daily basis creates a third-party risk.
Internet of Things (IOT) devices such as phones and computers increase your risk of a cyber attack.
Hardware components connected via Bluetooth are prone to hacking because the connection lacks encryption.
Networks that provide free access to wifi for customers are notorious for poor security monitoring. They create a new risk not just to the customer, but also to you, every time someone signs in.
Remote work arrangements can be a huge risk when not managed correctly. Are you supplying a secure VPN connection to your mainframe system for your employees at home? Who else has access to that laptop you sent home with your employee, and do you know whether anyone else uses it?
Do you monitor social media and check for imposter accounts that mirror your e-commerce site?
Do you have and enforce a clean desk policy for employees both on campus and at home?

If this seems overwhelming, it may help to chart a typical order’s journey through your system from the time it’s placed until it lands on the customer’s front steps.

Analyze and Immediately Remediate the Highest Risk Points

After identifying your cyber risks, analyze them. Physical stores are used to worrying mostly about shoplifting and employee theft, but need to apply a different risk assessment methodology when considering e-commerce risks.

Here are some examples of areas to scrutinize:

Make sure IT systems are up-to-date with the latest versions of software you use. If they aren’t, update everything. Most software updates protect against new cyber threats.
Take care that any credit card data and customer files are stored, accessed and processed in the safest manner possible. This includes using encryption and granting access only on an as needed basis.
Make sure you are protected against malware and viruses and that automation is used where possible, as it cuts back on human error.
Make sure your employees have the tools they need to keep your systems safe.

Monitor and Respond

Retail risk management is an ongoing effort. Once you’ve secured the fort, so to speak, ongoing monitoring and response is next.

Communicate your risk management process to all employees, and make sure everyone knows how to report a potential cyberthreat. Establish a chain of command relating to how you will respond to a data breach, security threat or cyberattack.

Software solutions based on automation and artificial intelligence (AI) can help keep you ahead of the cybercriminals who are changing their offense as frequently as you change your defense.

If the attacker gets in and causes damage, how will you repair your systems, recover your data and increase its protection, and remediate your brand? Make sure you can answer that question before a cyberattacker gets in.

Establish a Vendor and Third-Party Risk Management Program

The retail industry often ranks last among industries for application cybersecurity. Thale’s 2018 retail cybersecurity report provided these disturbing statistics:

50 percent of retailers said they had experienced a data breach.
84 percent of respondents planned to increase their spending on IT security.
85 percent of retail IT security professionals worked for companies storing sensitive data in the cloud.

The retail industry has no standardized framework for addressing security and the Internet of Things (IOT). And the cloud poses its own risks which should always be taken into consideration.

COVID forced many retailers to move online as quickly as possible, and for some this meant creating a whole new division within their business — often from scratch, and under great pressure to produce results quickly.

If you are one of the companies that went online in a hurry, now is a good time to assess how you manage risk associated with third-party vendors and partners. Here are some security points to consider:

Query your vendors and contractors about their cybersecurity approach, and inform them of your standards and expectations.
Make sure you know which vendors have access to any data your company is sharing.
Ask about your vendors’ remote working policies, and how they protect their infrastructure from hackers and other cyber threats.
Prepare for a potential data breach. Make sure you know how to respond to your customers and clients, as well as how to inform your employees.
Have a flexible plan for how to limit the damage if a hacker gets into your system.
Establish a clear chain of command internally and externally: how employees should report security and risk issues inside the company, and who will interact with your third-party vendors in case your own systems are compromised.
Remember that risk management is an ongoing endeavor. Make it part of your best practices every time you engage a new vendor.

To modernize your IT infrastructure — essential for customer engagement — your retail enterprise must move beyond traditional compliance. Instead, you must embrace “security first” cybersecurity strategies.

ZenGRC: Worry-free retail-risk mitigation

ZenGRC eases the burden of retail risk mitigation, and collects the documents you need at audit time automatically. Our user-friendly solution as a service (SaaS) helps with the following tasks (and more):

Streamlining workflows, including by integrating with ServiceNow and other popular workflow solutions
Viewing compliance gaps on user-friendly dashboards, and knowing how to fix them
Mapping controls to multiple frameworks, avoiding duplication of effort
Mapping controls to frameworks, standards, and regulations
Generating and sending vendor questionnaires, and collating the results
Conducting unlimited in-a-few-clicks self-audits
Storing audit-trail documents in our “single source of truth” repository
Sharing risk management and compliance status with managers and the board

ZenGRC lets you manage and monitor your retail establishment’s security and compliance worry-free. Our automated solution does much of the work so you don’t have to. Instead, you can focus on your customers and your bottom line. To find out more, contact us for your free consultation today.

Discover the full power of ZenGRC!

Get a Demo