Leading Technology through Controls and IPE Audits

Regularly review the risk and controls matrix

FRC, PCAOB, IAASB, JOA, etc. have all been working to increase the rigor and level of quality and assurance with regards to conducting audit and the requirements of the audit firms in their engagements. This translates into more information required to complete the assessment. Stay ahead of the audit before the engagement by preparing for the following due to increased / changed requirements.

The objectives to ensure the RACM is complete and accurate

Review the control objective language to ensure that it is accurate and the statements on how the system behaves to support the process.
Ensure that the mapped required configuration evidence that supports the control objective is accurate and matches the control language.
Regular review will help identify gaps between new controls where evidence has not yet been identified and logged in the library.

Evidence reporting for key and non-key controls

The goal of evidence reporting is to provide enough information that informs and assures that the controls are working and the evidenced configurations are complete and accurate so as to close out each request quickly and completely.

Have a detail explanation ready and reportable in business level lexicon of how the system configuration supports the control objective.
If the evidence is obtained via code (sql, etc), have the code and a detailed explanation along with the underlying objects and their definitions. If these are standard objects, references from the software company can be used (for example Oracle’s eTRM).
If the results of the evidence are not in line with the control language, work with the controls owner and controls leadership to provide rationale and possible mitigating controls when there is deviation.
Version your code. It will be audited and one of the determinations after baseline is if the code has changed or not. If this can not be proven, the code will most likely be audited for accuracy and completeness for every cycle.

Further on this as well as recommendations and guidance on IPE audits to follow.

Care to share your thoughts and recommendations? How are you leading technology through the audit?