Tips on Privacy Audits and Assessments Insurance Consumer Affairs Exchange October 2, 2005 Kirk Herath, CPO & Associate General Counsel, Nationwide Insurance Companies 1/17/2019 Attorny-Client Work Product -- Priviledged and Confidential

Compliance Monitoring Compliance Monitoring can take many forms: Audits   Market Conduct Exams Self assessments Third party assessments 1/17/2019

Critical Success Factor Critical Success Factor to meet compliance monitoring is a fully and formally documented Privacy Program to include all: Policies Procedures Controls 1/17/2019

AICPA Privacy Framework as a Model We used the AICPA Privacy Framework as our model. Ten Principles of a sound Privacy Program: Privacy Management Notice Choice & Consent Collection   Use & Retention Access Security Monitoring & Enforcement 1/17/2019

Know Your Business Units Know your Business Units via SAP’s (Singularly Accountable Person) in the business and functional Units. Conduct BU Privacy Self Assessments to gain granular insight in privacy practices and target those BU’s that use PII. Meet regularly with BU SAPs. Form a Virtual Privacy Office. 1/17/2019

Have a Broad Reach Have a Broad Reach. Form Partnerships with Internal Audits, Security, Compliance, Customers Relations. Leverage each others work and knowledge of business 1/17/2019

Internal Audits A partnership with Internal Audits is valuable particularly in the IT and Security Areas. However, Internal Audits may not have a comprehensive and in depth knowledge of regulatory and statutory rules nor knowledge of internationally recognized privacy principles. A privacy subject matter expert imbedded in audits may not be cost effective. If Internal Audits does request a review or, in fact, you ask for a review, be certain the audit plan, scope and objectives are clearly and concisely defined. (You can not be responsible for controls and practices you do not have authority to implement i.e. encryption.) 1/17/2019

Be pro-active in inviting audits, assessments and reviews. Supports ongoing updates and “currency” to policies, procedures and controls, due diligence and transparency. 1/17/2019

Third Party Assessment Consider an external third party assessment. Many firms have expertise in the privacy space and experience in auditing privacy programs. 1/17/2019

See an audit or assessment as a risk management opportunity. One that can affirm your approach is reasonable and robust. Or provide you with insight as to how to reduce your risk. 1/17/2019

If you fear an audit you very well may have reason to be afraid. Be Prepared. 1/17/2019