CAQ Provides New Tool to Help Auditors Avoid Judgment Tendencies, Traps, and Biases

Posted on by

Essentially, one version of a decision tree process for auditors.  This is a good training tool.  I would like to also see one of these for internal auditors.  The downside risk could be that it might become the standard for liability purposes.  On the other hand, if it does become the standard, then everyone, boards, CEOs, CFOs, audit committees, internal audit, etc. should expect that it will be followed.  The process does also include room for judgment anyway. Click on the following link for the Center for Audit Quality tool: www.thecaq.org

Dave Tate, Esq. (San Francisco / California)

PWC 2014 State of the Internal Audit Profession Study

Posted on by

The following is a link to PWC’s 2014 State of the Internal Audit Profession Study where you will find the study and also specific industry reports.  Worthwhile reading for all audit committees of entities that have internal audit functions.  You might be aware that the internal audit profession, and the IIA, have been going through an evaluation of where they are and where they want to be – to provide a function that is more valuable and respected.  As the audit committee is substantially dependent on other people gathering and reporting reliable information to the committee, I encourage all audit committees to sit down with the internal audit chair to explore better ways for internal audit to help the audit committee members perform their oversight function hopefully with security.  Click on the link below for the PWC Study page.

Dave Tate, Esq. 

http://www.pwc.com/us/en/risk-assurance-services/publications/pwc-2014-state-of-profession.jhtml

Why the Framework for Improving Critical Infrastructure Cybersecurity is useful for other risk management areas

Posted on by

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0, 2.12.2014

NIST – National Institute of Standards and Technology

-Question: Why is the Framework for Improving Critical Infrastructure Cybersecurity also useful for other risk management areas?

-Answer: Because it is a US Government recognized outline for risk management steps – although the Framework is voluntary for cybersecurity, at least at this time.

The following are the three primary Framework parts: Core, Profile and Implemental Tiers.

See also my prior post about possibly creating a standard of care, click here.

FRAMEWORK CORE

Identify – Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.

Protect – Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services.

Detect – Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event.

Respond– -Develop and implement the appropriate activities to take action regarding a detected cybersecurity event.

Recover – Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event.

FRAMEWORK PROFILE

Step 1:  Prioritize and Scope

The organization identifies its business/mission objectives and high-level organizational priorities. With this information, the organization makes strategic decisions regarding cybersecurity implementations and determines the scope of systems and assets that support the selected business line or process. The Framework can be adapted to support the different business lines or processes within an organization, which may have different business needs and associated risk tolerance.

Step 2: Orient

Once the scope of the cybersecurity program has been determined for the business line or process, the organization identifies related systems and assets, regulatory requirements, and overall risk approach. The organization then identifies threats to, and vulnerabilities of, those systems and assets.

Step 3: Create a Current Profile

The organization develops a Current Profile by indicating which Category and Subcategory outcomes from the Framework Core are currently being achieved.

Step 4: Conduct a Risk Assessment

This assessment could be guided by the organization’s overall risk management process or previous risk assessment activities. The organization analyzes the operational environment in order to discern the likelihood of a cybersecurity event and the impact that the event could have on the organization. It is important that organizations seek to incorporate emerging risks and threat and vulnerability data to facilitate a robust understanding of the likelihood and impact of cybersecurity events.

Step 5: Create a Target Profile

The organization creates a Target Profile that focuses on the assessment of the Framework Categories and Subcategories describing the organization’s desired cybersecurity outcomes. Organizations also may develop their own additional Categories and Subcategories to account for unique organizational risks. The organization may also consider influences and requirements of external stakeholders such as sector entities, customers, and business partners when creating a Target Profile.

Step 6: Determine, Analyze, and Prioritize Gaps

The organization compares the Current Profile and the Target Profile to determine gaps. Next it creates a prioritized action plan to address those gaps that draws upon mission drivers, a cost/benefit analysis, and understanding of risk to achieve the outcomes in the Target Profile. The organization then determines resources necessary to address the gaps. Using Profiles in this manner enables the organization to make informed decisions about cybersecurity activities, supports risk management, and enables the organization to perform cost-effective, targeted improvements.

Step 7: Implement Action Plan

The organization determines which actions to take in regards to the gaps, if any, identified in the previous step. It then monitors its current cybersecurity practices against the Target Profile. For further guidance, the Framework identifies example Informative References regarding the Categories and Subcategories, but organizations should determine which standards, guidelines, and practices, including those that are sector specific, work best for their needs.

“An organization may repeat the steps as needed to continuously assess and improve its cybersecurity. For instance, organizations may find that more frequent repetition of the orient step improves the quality of risk assessments. Furthermore, organizations may monitor progress through iterative updates to the Current Profile, subsequently comparing the Current Profile to the Target Profile. Organizations may also utilize this process to align their cybersecurity program with their desired Framework Implementation Tier.”

FRAMEWORK IMPLEMENTATION TIERS (I.E., THE EXTENT TO WHICH THE ENTITY HAS IMPLEMENTED THE FRAMEWORK)

Tier 1: Partial (first and lowest level of risk management practices) – Risk management practices are not formalized.  Risk is managed on an ad hoc and sometimes reactive manner. There is limited awareness of cybersecurity risk at the organizational level.  An organization may not have the processes in place to participate in coordination or collaboration with other entities.

Tier 2: Risk Informed (second level of risk management practices) – Risk management practices are approved by management but may not be established as organizational wide policy.  The organization knows its role in the larger ecosystem but has not formalized its capabilities to interact and share information externally.

Tier 3: Repeatable (third level of risk management practices) – The organization’s risk management practices are formally approved and expressed as policy. There is an organization-wide approach to manage cybersecurity risk. The organization understands its dependencies and partners and receives information from these partners that enables collaboration and risk-based management decisions within the organization in response to events.

Tier 4: Adaptive (forth and highest level of risk management practices) – The organization adapts its cybersecurity practices based on lessons learned and predictive indicators derived from previous and current cybersecurity activities. There is an organization-wide approach to managing cybersecurity risk that uses risk-informed policies, processes, and procedures to address potential cybersecurity events. Cybersecurity is part of the organizational culture and evolves from an awareness of previous activities, information share by other sources, and continuous awareness of activities on their systems and networks. The organization manages risk and actively shares information with partners to ensure that accurate, current information is being distributed and consumed to improve cybersecurity before a cybersecurity event occurs.

* * * * * * *

SEC and SOX 302 Violation

Posted on by

Below is a link to a discussion by Norman Marks. Please read Norman’s blog post. The following are my comments about the Sox 302 violation. In appropriate cases it would also be helpful for the SEC to discuss the actions or inactions of the audit committee and internal audit, such as in the factual background information – not necessarily to find fault or not with the audit committee or internal audit, but to bring them more in the public focus. The audit committee apparently was not aware of the situation – the committee has an oversight responsibility only; however, it would be useful to know some of the activities that the audit committee performed. Similarly, internal audit, if used correctly, might have been useful to detect the problems. I would want to know how internal audit was functioning, or not, and how it might be improved to benefit the audit committee’s oversight and the shareholders.

Dave Tate, Esq.
http://tatetalk.com

P.S. – I am told by a friend that the company is not listed on the NYSE, and accordingly there is no internal audit requirement.  Thank you Michael.  I have to acknowledge that I did not confirm the listing exchange.  That raises a whole host of other issues – such as, if there is no internal audit requirement, which companies should nevertheless decide to implement that function anyway?  DT

 

SEC and SOX plus COSO 2013 News | Norman Marks on Governance, Risk Management, and Audit.

Advancing the Practice of Internal Audit

Posted on by

As I mentioned earlier, I was honored to be a member of the Re-Look Task Force that has proposed changes to the IIA’s standards framework (IPPF).One of the changes is to introduce Core Principles f…

Source: normanmarks.wordpress.com

My comments in response to Norman’s blog post:

Why is internal audit needed?

– If it is required by law – but that doesn’t determine how much internal audit is required.

– If it provides value – but that depends on the amount of value provided and to whom.

I suspect that some management doesn’t find much value from internal audit, and might even find it intrusive. It is the board and its committees that really should benefit from internal audit. And it would help internal audit if regulators and other outside groups or organizations (proxy companies, perhaps?) started focusing some on the resources that companies are providing to internal audit – of course that might also lead to criticisms of internal audit itself.

Initially I did not believe that the new principles were very impressive. Norman, I appreciate your comments above. I see that from internal audit’s viewpoint at least a couple of the principles are improvements and forward looking. This was a step that internal audit apparently thought it needed to make in a formal manner. But this should be just a step – the promotion of internal audit is behind the times and opportunities, and should accelerate.

I have seen that there is a debate about just how far internal audit can go to not only audit but to also provide recommendations and improvements. Benefit added can be much greater with recommendations and improvements. It is for organizations like the IIA to determine how far internal audit can go with consulting, and making and perhaps designing recommendations and improvements, as long as internal audit isn’t auditing itself. For value added purposes internal audit should open up the opportunities for consulting, recommendations and improvements to the maximum extent that is deemed appropriate. Of course, the internal audit budget and personnel also need to be sufficient and qualified.

Thanks Norman for all your work.

Dave Tate, Esq. (San Francisco)
http://tatetalk.com

See on Scoop.it – Tate – Law, Liability, Risk Management, Governance, D&O and Business

Assessing Audit Control Risk (and Saving Time)

Posted on by

At times, auditors errantly assess control risk at less than high. Why? We have been told–correctly I might add–that “you can’t default to maximum risk.” While we can’t default to maximum (the old pre-risk-assessment-standards term), we can–and in many audits should–assess control risk at high (the risk assessment standards term). First the auditor should determine the […]

Source: cpa-scribo.com

Should the audit committee members ask their auditor about the auditor’s assessment of controls?  Yes. Will the answer mean anything to the audit committee members? That probably depends on the information that the auditor provides in reply and each audit committee member’s knowledge of the topic area.  See also the COSO Internal Control – Integrated Framework 2013, Executive Summary, click here.

See on Scoop.it – Tate – Law, Liability, Risk Management, Governance, D&O and Business

GAO – Executive Guide, Creating Value Through World-Class [Governmental] Financial Management

Posted on by

Here it is, way back in 2000 the GAO’s executive guide to world-class governmental financial management, are we there yet? – click here.

Enjoy,

Dave Tate, Esq., CPA (inactive), San Francisco/California, http://tatetalk.com

 

Video – Conservatorship of G.H. & Psychological Examinations

Posted on by

 

Video – The Dangers Of Risk Management For All By All

Posted on by

 

 

How Risk Analytics Can Chart Corporate Choices – CFO

Posted on by

Traditional metrics can help CFO get a firmer grasp of past or frequent events. But for future perils, risk modeling may be the way to go.

Source: ww2.cfo.com

See on Scoop.it – Tate – Law, Liability, Risk Management, Governance, D&O and Business