1. Tips on Privacy Audits and Assessments Insurance Consumer Affairs Exchange October 2, 2005 Kirk Herath, CPO & Associate General Counsel, Nationwide Insurance Companies
1/17/2019
Attorny-Client Work Product -- Priviledged and Confidential

2. Compliance Monitoring
Compliance Monitoring can take many forms:
Audits
Market Conduct Exams
Self assessments
Third party assessments
1/17/2019

3. Critical Success Factor
Critical Success Factor to meet compliance monitoring is a fully and formally documented Privacy Program to include all:
Policies
Procedures
Controls
1/17/2019

4. AICPA Privacy Framework as a Model
We used the AICPA Privacy Framework as our model.
Ten Principles of a sound Privacy Program:
Privacy Management
Notice
Choice & Consent
Collection
Use & Retention
Access
Security
Monitoring & Enforcement
1/17/2019

5. Know Your Business Units
Know your Business Units via SAP’s (Singularly Accountable Person) in the business and functional Units.
Conduct BU Privacy Self Assessments to gain granular insight in privacy practices and target those BU’s that use PII.
Meet regularly with BU SAPs. Form a Virtual Privacy Office.
1/17/2019

6. Have a Broad Reach Have a Broad Reach.
Form Partnerships with Internal Audits, Security, Compliance, Customers Relations.
Leverage each others work and knowledge of business
1/17/2019

7. Internal Audits
A partnership with Internal Audits is valuable particularly in the IT and Security Areas.
However, Internal Audits may not have a comprehensive and in depth knowledge of regulatory and statutory rules nor knowledge of internationally recognized privacy principles.
A privacy subject matter expert imbedded in audits may not be cost effective.
If Internal Audits does request a review or, in fact, you ask for a review, be certain the audit plan, scope and objectives are clearly and concisely defined. (You can not be responsible for controls and practices you do not have authority to implement i.e. encryption.)
1/17/2019

8. Be pro-active in inviting audits, assessments and reviews.
Supports ongoing updates and “currency” to policies, procedures and controls, due diligence and transparency.
1/17/2019

9. Third Party Assessment
Consider an external third party assessment.
Many firms have expertise in the privacy space and experience in auditing privacy programs.
1/17/2019

10. See an audit or assessment as a risk management opportunity.
One that can affirm your approach is reasonable and robust.
Or provide you with insight as to how to reduce your risk.
1/17/2019

11. If you fear an audit you very well may have reason to be afraid.
Be Prepared.
1/17/2019