ZenGRC

Simply Powerful GRC

SOX

Security and Compliance: Steps to Activate Your Wonder Twin Powers

· ·

Many view security and compliance as either competing interests or the same interests. In reality, they  Children of the 1980’s can remember the infamous Wonder Twins, siblings whose powers would only work when touching hands, leading to the iconic call, “Wonder Twin powers activate!” Security and compliance are the Wonder Twins of information security.

What Does Compliance Mean?

Compliance means following the guidelines set by regulations and standards to help meet best business practices. In some cases, such as HIPAA compliance, your organization works to avoid villainous penalties. In other situations, such as PCI DSS compliance, your company uses compliance to prove itself to vendors and customers.

A single compliance definition does not give you the real value of engaging in the process. Value comes from proving yourself a trustworthy ally with business partners. To gain revenue, you can use SOC 1 audit reports or SOC2/3 reports to help show your reliability and increase new avenues in which to scale your business.

While compliance may seem nothing more than a time-consuming slog, thinking about it as one half of the superhero power that invigorates your business can make it look less mundane.

What Does Security Mean?

Security comes from protecting information from unauthorized or malicious access. Security focuses on the hardware and software that store your data whether using firewalls, passwords, encryption tools, or other data and network safety measures.

Often, security seems to be the real superhero of infosec because its power thwarts the villains from theft. The steps of detection, prevention, and response through policies, protocols, and tools require the appropriate mechanisms to aid security endeavors.

How Compliance Aids Security

Just as the Wonder Twins needed one another to activate their powers, so your IT environment is stronger when you combine the power of compliance and security.

Compliance offers best business practices to aid your security efforts. Compliance with industry frameworks such as ISO, COBIT, NIST, and PCI DSS suggest protocols that have been tested and proven to protect environments. Regulations like HIPAA and Sarbanes-Oxley include monetary penalties, but they also created state-of-the-industry standards intended to protect IT landscapes.

Security informs compliance, too. PCI DSS compliance gives prescriptive step-by-step instructions for what to do and how to secure your information. Other compliance requirements, like HIPAA, require that you engage in risk assessments. When a risk assessment is necessary, you need to begin with your cybersecurity landscape and then move from there to establish the protocols and policies that best meet your needs.

How to Activate the Wonder Twin Powers of Compliance and Security

The first step creating an all-powerful compliance and security program is recognizing how to combine the two meaningfully.

Catalogue Your Environment

Your individual organization’s needs must come first. Despite the fear of auditors and regulators, you can be neither compliant nor secure if you do not know your IT assets. Determine where your information lives by system, hardware, or software.

Once you know how you manage your information, you can look at how those assets pose risks. For example, all your hardware may have Intel chips impacted by Meltdown and Spectre. However, the security threats arise out of physical access. These are different threats than those posed by ransomware which exploit security vulnerabilities through databases or lack of employee security training.

Cataloguing your environment gives you the insight needed to apply the security protocols to help you be compliant. While many organizations start with compliance as the guiding principle, the two twins need to work in tandem to help you best protect yourself and your customers.

Focus on Your Business Objectives

Business objectives should inform your security and compliance. If you’re not planning on taking payments, then you don’t need to meet the PCI DSS requirements. If you want to work with banks, then you need to know bank compliance standards.

Determine Your Compliance Standards

Once you know the locations of data and the business objectives, you can choose the standards that meet your needs.

Compliance offers several benefits that most companies ignore. First, if you plan to be a vendor for another business, then you need to prove your compliance because it provides peace of mind. Second, it creates an ongoing system of governance, risk, and compliance that keeps you from becoming complacent about your security. Third, it requires internal audits and external audits that aid in validating your protocols or finding areas where you can better strengthen your oversight.

The interconnected web of assets, business objectives, and standards keeps you both compliant and secure.

How Automation Strengthens Your Combined Security and Compliance

The way the Wonder Twins activated their powers was by connecting to one another. The mire of IT security and compliance often leaves stakeholders disconnected from one another, stymieing communication.

Automated SaaS GRC compliance tools, like ZenGRC, close that gap allowing you to activate your security powers so you can protect your environment from a malicious actor or security virus.

Shared Documentation

Sharing documentation to create a single source of information is the first step to closing the communication gap. By moving from spreadsheets to an automated system, everyone has precisely the access they need to make sure that your actions match your words. Further, with ZenGRC, you can provide the right amount of breadth or depth in a report to match your audience’s needs. Your Board of Directors can receive high-level reports tracking the threats and mitigations, while your CISO and CTO can have more detailed information indicating how compliant you are with individual standards.

Continuous Monitoring

Keeping your company secure means continually monitoring system updates that can put you at risk. As part of your governance program, you need to track your compliance to mitigate new threats. With ZenGRC, you have instant insight into the latest software updates with color-coded warnings to alert you and allow you to focus on the most critical patches.

Gap Analysis

Security means knowing what elements protect you from misuse of information. Compliance gives you ways to check that protection. As you scale your business, you may need to add new compliance areas, such as Sarbanes-Oxley. Adding a new compliance measure should be related to engaging in the appropriate security steps. With ZenGRC’s gap analysis tool, you can see what current controls match your new compliance efforts to help speed this process and ensure that you meet all requirements.

To learn more about how ZenGRC helps you activate your Wonder Twin powers, schedule a demo today.

6 Ways SOX Compliance Benefits An Organization

· ·

6-sox-compliance-benefits

After Sarbanes-Oxley Act of 2002 (SOX) was enacted, companies were forced to rethink their reporting to avoid penalties, but SOX compliance brings significant benefits. The new approach to financial reporting that SOX created engenders greater market trust. In fact, for private companies considering going public, these SOX compliance benefits manifest, first, as better IPO pricing. A 2014 Forbes article written by Harvard Business School Working Knowledge notes,
Despite high initial costs of the internal control mandate, evidence shows that it has proved beneficial….Another concern that the act would shrink the number of IPOs has not been borne out either; in fact, the pricing of IPOs post-SOX became less uncertain. The cost of being a publicly traded company did cause some firms to go private, but research shows these were primarily organizations that were smaller, less liquid, and more fraud-prone.
In other words, SOX implementation has strengthened the public market. A company’s SOX compliance communicates a baseline level of financial assurance in publicly-traded companies, which inspires both investor confidence and market certainty. SOX has cleaned the market of less financially-reliable companies, while new publicly-traded entrants can command higher IPO pricing. This has increased overall market strength, as well as individual corporate financial stability.
These advantages represent macro-level improvements to the broader marketplace. But what are the impacts of SOX at the level of a particular company?

Six Ways SOX Compliance Benefits the Organization

  1. Risk Triage

    Not all risks are created equal. SOX compliance benefits companies by giving them a starting point for asset analysis. SOX articulates expectations, so that organizations can predict the standard they will be held to. Understanding risks means being able to more effectively target your controls. The Information Systems Audit and Control Association (ISACA) explains,
    The most appropriate and effective way to define the right scope and the extent of testing for each Sarbanes-Oxley in-scope system is to perform a risk assessment focusing on the risks associated with Sarbanes-Oxley requirements and specific to ITGC. Risk assessment is not a new buzzword-everyone in today’s world talks about risk-based approach, risk assessments, etc., but few understand that for a risk assessment exercise to be successful, it is extremely important to identify whether the focus of risk assessment is confidentiality, integrity and/or availability, and then to define the risk criteria/parameters.
    For example, a risk assessment exercise for Payment Card Industry (PCI) Data Security Standard (DSS) compliance focuses on what should and should not be stored to ensure that credit card information is not compromised and, thus, to ensure data privacy. However, for Sarbanes-Oxley, the same approach cannot be applied, because Sarbanes-Oxley focuses on data integrity and misstatements to financial reporting. Therefore, the risk assessment criterion shifts from data privacy to data integrity.
    Focused risk assessments mean understanding the landscape of the organization’s risk exposure and controls. By learning what areas do not need to be SOX compliant, the company can focus its efforts on the in-scope areas that are the greatest risk. In addition, by learning what areas are subject to SOX and how they fit into the compliance profile, internal stakeholders gain insight into how various types of compliance overlap.

  2. Control Structure Strengthening

    Sections 302 and 404 require documentation of controls, including operations manuals, personnel policies, and recorded control processes. With this kind of documentation mandatory, many organizations may find the process overwhelming. However, the steps needed to comply can be productive for the company.
    One benefit of SOX compliance is better control awareness; how these controls fit into the big picture becomes more transparent. When auditors and management focus on internal controls through a SOX assessment, the organization quickly become more aware of how important control activities are to the financial success of the organization. The additional scrutiny that comes through a SOX assessment prompts participants to put forth even more effort to ensure that activities important to financial reporting are well-executed.
    As businesses grow, organic changes can affect controls as the company matures. Organizations that prioritize compliance sooner experience SOX compliance benefits at an earlier stage. In 2006, The Harvard Business Review‘s writers Stephen Wagner and Lee Dittmar wrote,
    PepsiCo has also benefited from updating its documentation processes. In the course of making these updates, the company determined that inadequate controls existed for pension accounting, a complex process that depends not only on the internal compensation and benefits group but on external actuaries and asset custodians. Lardieri says with dismay, “A lot of steps we assumed were being taken-account reconciliations and interest calculations and data integrity checks-actually weren’t.”
    Although it was not why they began the endeavor, PepsiCo discovered unanticipated gaps and faulty assumptions while improving controls. Organizations just starting the process may be surprised by the benefits they encounter while pursuing SOX compliance.
    The process may also highlight inefficiencies in how documentation is generated and stored. For those using spreadsheets to document their SOX compliance, information may end up scattered across an organization. Automated tools provide a single location for the documentation, providing the necessary artifacts to demonstrate controls.

  3. Better Audits

    While “better audits” is imprecise, the description’s vagueness encompasses many different aspects of the audit process. The 2016 Protiviti Sarbanes-Oxley Compliance Survey research noted that

    • For a strong majority of public companies (85 percent), either the audit committee or executive management is the executive sponsor for SOX compliance efforts. The audit committee is responsible for the broad overview of the organization’s risk management, under which SOX compliance falls. Executive management is specifically responsible for the accuracy and completeness of the organization’s internal control over financial reporting – a key component of the SOX requirements. Therefore, it makes sense that executive sponsorship falls under one of these bodies.

    • Internal audit is primarily responsible for the execution of these activities in one out of three companies (35 percent). Within a majority of organizations, either internal audit or management and/or process owners have this responsibility.

    • When it comes to testing, two-thirds of public companies rely on either their internal audit groups (46 percent) or management and/or process owners (21 percent).

    • Internal auditors performing and supporting testing efforts is not surprising, given their skill sets and independence to enable external audit reliance.

    More effective and efficient operations lead to better audit outcomes. With better internal audit outcomes, the external audit process becomes more efficient. Streamlining external audit lowers overall audit costs by lowering the cost of employee time responding to external audit requests and report results. Creating better audit evidence collection smooths user experience supporting auditors. One key way to achieve this evidence collection is with an automated platform, like ZenGRC, which provides dashboards that make Audit project management easy.

  4. Efficient Financial Reporting

    The main goal of SOX was to provide transparency in financial reporting. In doing this, the statute defined minimum standards for determining reliable information. COSO described what early efforts to comply often looked like:
    First, management probably specified a high-level financial reporting objective and sub-objectives related to preparing financial statements and disclosures. In doing so, it identified significant financial statement accounts based on the risk of material misstatement. Then, for each account or disclosure, management identified relevant financial reporting assertions, including existence, completeness, rights and obligations, valuation or allocation, presentation and disclosure, and the like. In addition, management identified underlying transactions, events, and processes supporting the respective accounts and disclosures. The result may have been a mapping of the design of your company’s internal control environment, providing evidence that control activities are in place for all relevant financial reporting assertions for all significant accounts and disclosures. If there were any significant gaps, you remediated them accordingly.
    Despite the effort needed to gather documentation and strengthen controls, completing this process allows for more-efficient, more-reliable financial reporting. Once the effort to map the control environment has been completed, the organization has grappled with compliance requirements. It is positioned, for future years, to track material changes. This makes reporting easier as the organization matures. More accurate financial reporting means less time spent needing to correct mistakes.

  5. Peak Operational Performance Early On

    Early engagement with SOX compliance benefits companies by instilling process efficiencies that position it for future growth. In his Institute of Internal Auditors North American presentation, Steve Guarini, formerly with Rehmann Group now with Cohen & Company, noted that SOX compliance would

    • Utilize a top-down approach to drive efficiency and effectiveness

    • Focus on areas of high risk, significant accounts, processes, and locations

    • Take a practical approach to “right-sizing” documentation

    • Focus on key controls versus all controls

    • Integrate IT and business processes and to maximize the benefits of controls

    • Build the control structure with the goal of maximizing operational and auditing efficiency and minimizing compliance costs

    When organizations initiate controls at an early stage, SOX compliance benefits companies by motivating them to assess their starting points and annually assess their risk. This means that controls cannot be haphazard. By beginning with a streamlined approach to risk that integrates multiple business areas, organizations can operationalize best practices early.

  6. Team Collaboration and Build Working Relationships

    SOX compliance requires deeper and more frequent collaboration among internal stakeholders. Particularly in the area of IT security, attempting to operate in isolation will constrain compliance efforts. Ernst & Young note:
    As the threat landscape rapidly changes and risks increase, companies need to change their mindset and approach toward information security and privacy to address a new normal… These are issues of importance to the C-suite, elevating the need for boards of directors, audit committees, general counsels and chief risk officers to work alongside information security and privacy officers to fully address their organization’s risk management level of due care, approach and preparedness, and to implement an Information Technology Risk Management program that is adequate and effective in managing cyber risks.
    Internal auditors and those who oversee SOX assessments must collaborate across business lines to work with those who own or contribute to financial and information controls, such as control owners, IT, or HR. SOX requirements incentivize building stronger working relationships across teams.
    At the heart of this collaboration lies communication. Automated GRC tools, like ZenGRC, ease collaboration by creating a single, accessible location where the stakeholders can meet. This location also can be controlled, providing appropriate access based on compliance role.

Looking to get started with SOX compliance and curious about how an automated tool can help? Contact one of our GRC specialists.

Understanding SOX Requirements & The Sarbanes-Oxley Act

· ·

The Sarbanes-Oxley Act of 2002 (SOX), named after Paul Sarbanes and Michael Oxley, is a law that implements regulations on publicly traded companies. In 2002, the US Congress passed the Sarbanes-Oxley Act (SOX) after a series of public scandals by large corporations such as Enron Corporation, Tyco International PLC, and WorldCom that led to a stock market plummet only a few months before the 2002 elections.

The legislation intended to quell public fears of corporate misconduct and to require greater accountability by management and Boards of Directors when reporting financial data. However, Sarbanes-Oxley turned into a larger and more complex piece of legislation than originally planned.

The Major Provisions of Sarbanes-Oxley

The Sarbanes-Oxley Act of 2002 presented five main provisions. First, it created the Public Company Accounting Oversight Board (PCAOB) and imposed restrictions on public accounting firm auditors including independence standards. Second, it established corporate governance requirements that created audit committee safeguards. Third, the legislation added disclosure requirements for the financial reports and press releases. Fourth, the Sarbanes-Oxley Act of 2002 established criminal penalties for public companies and the CEOs and CFOs in the event of falsely certifying financial reports.  Fifth, Sarbanes-Oxley Act (“SOX”) established criminal penalties of 20 to 25 years for obstruction of justice and securities fraud in the hope of further deterring the types of activities that had led to the 2001 and 2002 scandals.

Sarbanes-Oxley Compliance

Sarbanes-Oxley compliance requirements fall into several different areas. Many of these areas focus on corporate responsibility and corporate governance. Within those, however, some specific issues for information security exist as well. Many feel overwhelmed by SOX compliance. As with any legislation, the reality  lies in focusing on what pertains to an individual organization not just the overall law.

SOX Section 302

Section 302 focuses on Disclosure Control and Procedures. In short, SOX 302 disclosures are traditionally unaudited, but still reviewed by the independent auditors, quarterly reports that discuss all the processes and controls in place for public disclosures. This section of the legislation also focuses on the personal accountability of signing officers. The direct excerpt from the Sarbanes-Oxley Act of 2002 (SOX) notes:

  1.   the signing officer has reviewed the report;
  1.   based on the officer’s knowledge, the report does not contain any untrue statement of a material fact or omit to state a material fact necessary in order to make the statements made, in light of the circumstances under which such statements were made, not misleading;
  1.   based on such officer’s knowledge, the financial statements, and other financial information included in the report, fairly present in all material respects the financial condition and results of operations of the issuer as of, and for, the periods presented in the report;

In easy to understand terms, this means that if an executive officer signs a document, they personally take responsibility for it being true, for it fully disclosing all relevant procedures, and for it clearly detailing any changes that occurred during the period of the report.

SOX Section 401

SOX 401 includes two sections of note. First, it focuses on financial disclosures being prepared in accordance with specified accounting standards to ensure investor confidence Second, Sarbanes-Oxley 401 requires the reporting of off-balance sheet disclosures to ensure that those transactions meet these accepted accounting rules. The reports in 401 specifically relate to the annual and quarterly public financial reporting that had been misrepresented during the Enron and WorldCom scandals. Unlike the section 302 disclosures, these are formally audited by a public accounting firm.

SOX Section 404

At its basic level, Section 404 of the Sarbanes-Oxley Act (SOX) focuses on the scope and adequacy of the internal controls and procedures for financial reporting. This section of the Sarbanes-Oxley Act has farther reaching tentacles than any other and where most organizations struggle and spend the majority of their Sarbanes-Oxley compliance efforts. The SEC’s brochure outlines the steps to evaluating and documenting internal controls. First, a company needs to look at its reporting risks.

These risks may be internally or externally inherent in the business. They may come from the authorization, process, and record transactions reflected in financial statements.  When evaluating these, the United States Securities and Exchange Commission (SEC) suggests an organization ask the following questions:

  • How do entity level controls relate to financial reporting elements? With what level of precision do they operate?
  • Is there more than one control that addresses the same financial reporting risk? If so, which one provides the most efficient way for you to evaluate how well it works?
  • Is the control automated? If so, how sturdy are the relevant IT controls? Or is the control manual – and if so, what is the risk of human error?
  • Not every control within a particular process needs to be identified – only those that adequately address financial reporting risks.

The second step is to determine whether the controls work and the risk in the event that the controls fail. The greater the risk, the greater the evidence needed to support effective controls. The third steps would be reporting these conclusions on overall effectiveness and deficiencies. If an organization finds a material weakness, the controls cannot be considered effective.

The SEC guidance defines a material weakness as “one or more control deficiencies that create a reasonable possibility of a material misstatement in your company’s annual or interim financial statements. This does not necessarily mean that a material misstatement has occurred, but only that the controls might not be good enough to detect or prevent a material misstatement on a timely basis.” Materiality can differ from one company to the next, but it’s really about the logic behind the corporate decision and auditors’ evaluation of materiality.  SOX 404 requires management maintain reasonable support for its assessment. These could include the design of the control, the way evidence was gathered and evaluated, or the basis of the assessment on the operating effectiveness of controls.

SOX Section 409

SOX 409 is referred to as the “Real Time Issuer Disclosures” section. The Sarbanes-Oxley Act states, “Issuers are required to disclose to the public, on an urgent basis, information on material changes in their financial condition or operations. These disclosures are to be presented in terms that are easy to understand and supported by trend and qualitative information of graphic presentations as appropriate.” In short, if an event occurs that leads to a big change in financial conditions or operations, the company needs to tell shareholder and stakeholders right away. In the world of information security, a security breach would be considered a material change.

SOX Section 806

SOX 806 focuses on the whistleblower protections. In an attempt to protect employees wanting to do the right thing, Sarbanes-Oxley gave the U.S. Department of Labor protection control of these employees. If a company retaliates against an employee for providing information of a violation, the Department of Justice can criminally charge the responsible parties.

SOX Section 906

SOX 906 forces corporate responsibility for filing of financial reports. Over the course of time, standard documents have been drafted for CEOs and CFOs to submits with their periodic SEC financial statement reports. Unlike the SOX 302 certifications that include the concept of “knowingly” within them, the SOX 906 certifications are more straightforward.

Sarbanes-Oxley and Information Security

For information security professionals, the overlap of SOX 302 and SOX 404 creates the most risk in terms of SOX compliance. 302 discusses the personal certification of financial reporting controls by the CEO and CFO. 404 focuses on the broad term “internal controls.” Neither of these sections specify a definition for control leaving it open for all interpretations, including those related to information systems.

Sarbanes-Oxley created the PCAOB to guide the auditor through best practices. However, the standards provide little insight into the terms IT controls. A 2004 SANS white paper provides a detailed look at how to piece together Sarbanes-Oxley compliance and IT controls. The PCAOB did select the Committee of Sponsoring Organizations (COSO) framework to create guidelines for structuring every internal control. Although the legislation does not specifically require the COSO framework, the PCAOB’s adoption of it makes it a safe choice.

The COSO framework addresses areas of compliance such as information security controls, control environment, risk assessment control activities, information and communication and monitoring.

To close the last gap of compliance, many organizations turn to the Control Objectives for Information and related Technology (COBIT) framework. COBIT organizes 34 IT processes into categories of planning and organization, acquisition and implementation, delivery and support, and monitoring. Finally, by ensuring that an organization has a security policy, security standards, access and authentication procedures, network security details, monitoring, segregation of duties, and physical security, a company will be able to put together an appropriate Sarbanes-Oxley compliance program.

The biggest challenge for IT security departments lie in appropriate access. Although the security requirements appear more lax than other regulations like the Payment Card Industry Data Security Standard (PCI DSS) or ISO 27001, it often leads to the foundation of best practices. Jeff Jenkins from Travelport notes on TechTarget,
One of the most specific requirements involves monitoring user access to data. This requires mature procedures for user provisioning, de- provisioning and granting privileged access to modify or administer data systems. Nearly every IT security standard includes requirements to monitor and control system and data access, and Sarbanes-Oxley requires auditors and IT personnel to regularly review practices such as access rights. Under Sarbanes-Oxley, however, senior-level management is also required to sign-off on those reviews, so SOX-compliant organizations tend to have more mature access control procedures.

Regular access reviews can not only lead to SOX compliance, but as a best practice ensure security for the organization. In this manner, Sarbanes-Oxley compliance has the unintended benefit of helping to protect companies from malicious intrusion.

While Sarbanes-Oxley may have been a great shake up to corporate culture in 2002, its ongoing legacy helps to establish not just financial reporting trust but also information security best practices.

If you’re looking for ways to automate your Sarbanes-Oxley compliance to help streamline the process, please contact one of ZenGRC’s experts.

Keep it Private: SOX Compliance and Private Companies

· ·

how to build a compliance program

Smaller, privately held companies often view the Sarbanes-Oxley Act of 2002 (“SOX”) as being within the purview of large, publicly held corporations. Enacted in the wake of a steady stream of corporate misdeeds, SOX intended to protect employees and the public from corporate greed. Many small businesses, therefore, feel that SOX compliance is too large a cost, both in time and money, to apply to them.

Sections 302 and 404 Can Apply To Privately Held Companies

Although the financial reporting aspects of SOX do not apply to privately held companies, several sections of the bill integrate data management, reporting, and security. Section 302, although relating to financial reporting, focuses on internal controls to the extent financial information is stored electronically. Section 404 requires that businesses have an annual audit of their internal controls related to accounting and financials. Although these Sections may not specifically target privately held companies, they do affect them. The technology industry is strongly peer-driven.  If competitors are SOX compliant, then customers will see compliance as a key differentiator.

For a privately held company, SOX compliance may not be formal. However, the business climate that the regulation created in the peer-driven IT community does mean that some form of compliance is often necessary. Some privately held businesses provide third party services to larger publicly held companies. Therefore, SOX compliance, whether formal or informal, matters to all companies who want to stay competitive.

SOX Compliance As Value-Add

At the end of June, Protiviti released its survey report Understanding the Costs and Benefits of SOX Compliance. Spanning publicly held, privately held planning IPO, and privately held companies, the information showed the importance of SOX compliance to organizations. According to Protiviti’s analysis, the bottom line is that compliance had a significantly front-loaded investment. After year three, moderate or significant improvements were reported. In addition, Protiviti noted that employing best practices such as automating more of the key controls had a “positive ripple effect” throughout the whole company.

Using a GRC Platform

Using GRC software like ZenGRC can help with the process of documenting and automating these key controls. ZenGRC provides a continuously updated library of best practices and strategies. This library can help with structuring a formal SOX compliance program. It allows those companies intending to follow trends of compliance without the overarching formality of audits to streamline their decisions. The individualization that this library of best practices creates lowers the frontloaded time investment.

Many privately-held companies are looking to move towards SOX compliance simply as a best business practice and way to stay competitive in a peer-driven market. As such, companies looking to find the best way to cut down on the upfront human capital needed for compliance should think about investing in a compliance software tool.

Top 3 Challenges When Updating Your Compliance Framework

· ·

Well, it’s happened again. The framework you worked so hard to implement across your company needs updating. This typically occurs every 4-6 years to provide organizations with enough time to prepare. For example, Sarbanes-Oxley, GLBA/FFIC, FISMA, and HIPAA are frameworks associated with traditional computing. Traditional frameworks like these took a long time to update. Yet, in the last several years, frameworks covering new technology change every 2-3 years. Standards that cover cloud, mobile, encryption, and vendor management fit this new model.  Thus, you will need to prepare to update your framework on an annual basis to keep up with all the changes.

Each change to your existing compliance framework will pose a challenge. First, you should understand the impact the changes will have on your audit program. Are the changes minor and only require rewriting controls? Are the changes in adding new controls that you need to anticipate?

Compliance specialists will have an advantage over most general compliance professionals. Specialists tend to focus on one or two standards only. They can spend more of their time focusing on a domain and know everything about it. Most organizations have many compliance needs and cannot just rely on specialists.

A compliance program should cover all aspects of compliance for an organization. It is best operated by a compliance professional that is able to manage company-wide compliance. Managing compliance requires someone who knows a lot about a lot of domains. It also requires someone who can rely on specialists.  With each framework update, a compliance professional will need to approve the changes. Juggling the number of changes can be frustrating to manage. You should anticipate the challenges below and prepare for the inevitable changes to your compliance framework.

Challenge # 1 – Understanding the impact to your audit program

At first glance, updating your compliance framework may look like an exercise in copying and pasting the old text with the new text. This is rarely the case. Each compliance standard iteration will undergo a Q&A session by the compliance community. This will impact the interpretation of the new standard beyond the written controls. The impact to your audit program will require you to carefully review each change in detail. The reason this becomes so difficult is that your audit program may live in many places such as:

  • Many Excel spreadsheets with controls specific to a business unit/division
  • If the COSO/COBIT component was not updated, it will make it more difficult to apply the changes from the underlying domain.
  • Existing audit timeline with agreed scope, or signed contract mapped to the now older framework
  • Managing stakeholders, especially if their interpretations differ from the compliance team’s consensus

Many of these impacts can be better managed if you have a clear understanding of the net results in your audit program. If you can, use a tool that will evaluate each change and trace it through to your test plans, audit dependencies, and update the underlying data. Missing just a few updates can create unexpected audit gaps that can turn into audit findings. Although updating frameworks poses a risk to every audit, compliance professionals should be proactive. They should trace the changes and their impact.

Challenge # 2 – Updating the controls

If you store your controls in a central repository, you will be able to update the controls faster. Hunting down all the files across many locations will pose a bigger challenge. Every version of the file with your controls needs updating. Also, it can be common for updates to undergo updates too. You may need to go back and update the controls several times. As the compliance community implements the changes, they may find errors in it. This will produce more framework updates. Keeping a list of those changes and tracking version control is important. You want to update your controls across all instances.

Custom frameworks will pose more challenges. If you created a custom, best-of-breed framework that pulled from many domains, you will need to understand all the dependencies. If you used one domain as your foundation, you will need to trace those changes to all frameworks relying on that foundation.  Each customization and each translation can magnify the amount of work. For example, any parent control or larger framework may need updating. That means that instead of just updating the controls within the new framework, you now need to update your internal inventory of controls that reference the new changes. For example, if you are updating controls form PCI 3.0 to PCI 3.1 that would be a somewhat straightforward update. But if your controls were built on SOC 2 or FedRAMP frameworks, you would have more to do. The changes to PCI 3.1 around vendor management, for example, may change the scope of your SOC 2. If you used FedRAMP, the area for key management would more attention. These granular impacts can add more work. That extra step becomes even more complicated when you use a COSO, or COBIT framework because they are not designed to be nimble.

Tracing the new changes and updating the controls will be an activity that will take at least 40 to 80 hours. Unless you have a tool. A tool can automate some of the menial tasks such as change control wording. It can also ensure all changes reach each instance where the controls live. It can also help in understanding the impact, such as before and after impacts. Without a tool to help, the changes will take longer to make and more likely to contain errors.

Challenge # 3 – Aligning your audit to the latest changes

Work with your external auditor, or assessor to understand the audit impacts. You should have a conversation early in the audit period. It would be ideal if you contact them at least 6 months before the start of their onsite activities. The reason for this is that you may need to prepare specific evidence that shows that you updated your framework. You may also need to add controls to your audit program that require a sample size of at least 6 months. The conversation should be straightforward because the external auditors will be fielding many of the same questions. They should also provide a specialist or a webinar where a specialist speaks to the changes. This way you will be better informed of the changes and have enough time to process them.

Ask the auditor to tell you about the challenges of other organizations. Learn from their mistakes where possible. Keep the dialogue open and apply what you learn so that you can prepare.

Conclusion

The reality is that new changes to frameworks will only increase in frequency. Technology and cyber risks are pushing the threshold of compliance frameworks. As attackers, breaches, and fraud methodologies evolve, the frameworks will need to adapt. Using a process and a tool that will help compliance professionals keep up with the changes will become even more important. Consider your solution and keep these challenges in mind when updating frameworks.

Photo Credit: John Mcsporran