The Evolution of IT Risk & Compliance February 2012 Rosalyn Ellis, CRISC Susan Hoffman, CISA,CGEIT 1

Achieving SOX Compliance Developed set of control requirements  Application Change Management  Application & Data Security Documented existing controls and processes Established new controls and processes 2

Issue at hand... Review, assess, consider materiality of issues, priority, determine level of audit issues/complexity to close gaps Evaluated and documented IT controls Clarified “ownership” for the controls New applications / solutions introduced to environment requiring proper controls 3

Established a team… Purpose  implement according to policy  audit to the policy Partners with... Internal & External Audit teams Determine needed IT controls Define how to test the controls IT staff: Build compliance into IT solutions Determine ways to align compliance efforts with IT initiatives 4

IT Risk & Compliance… Assembled list of IT controls according to policy identifying specific frequency and owners Established Self-Audit Program Conduct self-audit test on each IT control Identifies gaps with the existing IT controls Provides for auditor reliance on self-audit results 5

6

Benefits of Self-Audit Program The IT Organization Assumes responsibility for the IT controls Gains confidence that IT controls and processes are effective and efficient Identifies control weaknesses in advance of Internal or External Audit tests Identifies process improvements with current controls and processes 7

Benefits of Self-Audit Program 8

Beyond Self-Audit Concepts Database Activity Monitoring (DAM)  Explore other uses for current tool Business Processes comply with eDiscovery requirements Self Audit of Business Application SOA Architecture Self Audit of Mobile Applications 9

Expanding Self-Audit Concepts Coordinate Assessments  Internal Risk Assessments  3 rd Party Assessments Current Topics & Technology  Cloud Computing  PII  PCI 10

Questions? 11