IT Governance, Risk, and Compliance (ITGRC)

Businesses rely on their IT departments and resources for competitive advantages and business to business transactions and cannot afford to apply to IT anything less than the same level of commitment they devote company assets. IT offers extraordinary opportunities to transform the business; however IT must deliver value and enable the business, and IT-related risks must be mitigated. Governance of IT, Information Security, and Risk Management encompasses several initiatives for executive management. At a glance, they must be aware of the role and impact of IT on the enterprise, define constraints within which IT professionals should operate and measure performance, understand risk and obtain assurance.

Corporate Governance:

Before discussing Information Technology and Security Governance, one must look at that broader issue of Corporate Governance in the enterprise. Corporate Governance is defined as a structure for determining organizational objectives and monitoring performance to ensure that business objectives are attained. Corporate Governance became a dominant business topic in the wake of many corporate scandals – Enron, WorldCom and Tyco, and is becoming increasing popular today in the wake of TJX credit card breach case. Companies generating interest in corporate governance is not new, but the severity of the financial impacts of the many scandals undermined the confidence of the investment community and corporate stakeholders.

Good corporate governance is important to investors and shareholders. As a matter of fact, many investors, before making an investment decision, validates and ranks the company’s corporate governance on par with its financial indicators. As a matter of fact, some investment firms are prepared to pay large premiums for investments in companies with high governance standards.

Whilst there is no single model of good corporate governance, it is noted that in many countries corporate governance is vested in a supervisory board that is responsible for protecting the rights of the shareholders and stakeholders. The board, in turn, works with a senior management team to implement governance principles that ensure the effectiveness of organizational processes.

IT Governance Role:

IT governance is the responsibility of the board of directors and executive management. It is an integral part of corporate governance and consists of the leadership and organizational structures and processes that ensure that the organization’s Information Technology sustains and extends the organization’s strategies and objectives. Also, IT governance is the term used to describe how those persons responsible for governance of an entity will consider IT in their supervision, monitoring, control and direction of the entity. How IT is applied within the business will have an immense impact on whether the business will attain its vision, mission or strategic goals. In today’s economy, and with most businesses reliance on IT for competitive advantage, businesses simply cannot afford to apply to their Information Technology anything less than the level of commitment they apply to overall governance.

Who is Responsible for IT Governance and Risk Management:

Board of Directors (BODs) and executive management have a joint responsibility to protect shareholder value. This responsibility applies just as stringently to valued information assets as it does to any other asset. BODs and management must recognize that securing information and information assets is not just an investment; it is essential for survival in all cases and for many it guarantees competitive advantage. Additionally BODs and management must accept the responsibility of ensuring that:

• IT Governance is aligned with the overall Corporate Governance structure within the enterprise.
• IT Governance includes an alignment with the Enterprise Risk Management Program, which is a responsibility of the BODs and Management
• There is a balance of the operational and economic costs of protective measures and achieve gains in mission capability by protecting the IT systems and data that support their enterprise’s business strategy and objectives.
• Risks and threats are identified, categorized and mitigated to acceptable levels.
• IT Governance obtains coordinated and integrated action from the top down.
• IT investments are not mismanaged or misdirected.
• IT Governance rules and priorities are established and enforced.
• Trust is demonstrated toward trading partners while exchanging electronic transactions.

In Closing:

IT governance covers a number of activities for the board and for executive management, such as becoming informed of the role and impact of IT on the enterprise, assigning responsibilities, defining constraints within which to operate, measuring performance, managing risk and obtaining assurance.
IT Governance is focuses two categories: (1) IT’s delivery of value to the business and (2) mitigation of IT risks. In order to have an effective IT and Security Governance strategy businesses must address the following questions:

• What decisions must be made to ensure effective management and use of IT?
• Who should make these decisions?
• How will these decisions be made and monitored?

Always remember that managing information security risks as part of operational risk involves establishing an effective IT governance and control architecture.


Thank you

James Sayles
MBA, BS, CISSP, CISA, CISM
Vice President, Chief Risk and Compliance Officer
Favored Solutions

Enterprise Risk Management Framework

Two important ERM frameworks are COSO and RIMS. Each describes an approach for identifying, analyzing, responding to, and monitoring risks or opportunities, within the internal and external environment facing the enterprise. Management selects a risk response strategy for specific risks identified and analyzed, which may include:

1. Avoidance: exiting the activities giving rise to risk
2. Reduction: taking action to reduce the likelihood or impact related to the risk
3. Share or insure: transferring or sharing a portion of the risk, to reduce it
4. Accept: no action is taken, due to a cost/benefit decision

Monitoring is typically performed by management as part of its internal control activities, such as review of analytical reports or management committee meetings with relevant experts, to understand how the risk response strategy is working and whether the objectives are being achieved.

COSO ERM framework:

The COSO "Enterprise Risk Management-Integrated Framework" published in 2004 defines ERM as: "A process, effected by an entity's board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives."

The COSO ERM Framework has eight Components and four objectives categories. It is an expansion of the COSO Internal Control -Integrated Framework published in 1992 and amended in 1994. The eight components - additional components highlighted - are:

• Internal Environment
• Objective Setting
• Event Identification
• Risk Assessment
• Risk Response
• Control Activities
• Information and Communication
• Monitoring

The four objectives categories - additional components highlighted - are:

• Strategy - high-level goals, aligned with and supporting the organization's mission
• Operations - effective and efficient use of resources
• Financial Reporting - reliability of operational and financial reporting
• Compliance - compliance with applicable laws and regulations

RIMS risk maturity model for enterprise risk management:

Enterprise risk management (ERM) as defined by the Risk and Insurance Management Society (RIMS) is the culture, processes and tools to identify strategic opportunities and reduce uncertainty. ERM is a comprehensive view of risk from both operational and strategic perspectives and is a process that supports the reduction of uncertainty and promotes the exploitation of opportunities.

According to the RIMS Risk Maturity Model for ERM, the following seven core competencies, or attributes, measure how well enterprise risk management is embraced by management and ingrained within the organization. A maturity level is determined for each attribute and ERM maturity is determined by the weakest link.

1. ERM-based approach - Degree of executive support for an ERM-based approach within the corporate culture. This goes beyond regulatory compliance across all processes, functions, business lines, roles and geographies. Degree of integration, communication and coordination of internal audit, information technology, compliance, control and risk management.

2. ERM process management - Degree of weaving the ERM Process into business processes and using ERM Process steps to identify, assess, evaluate, mitigate and monitor. Degree of incorporating qualitative methods supported by quantitative methods, analysis, tools.

3. Risk appetite management – Degree of understanding the risk-reward tradeoffs within the business. Accountability within leadership and policy to guide decision-making and attack gaps between perceived and actual risk. Risk appetite defines the boundary of acceptable risk and risk tolerance defines the variation of measuring risk appetite that management deems acceptable.

4. Root cause discipline - Degree of discipline applied to measuring a problem’s root cause and binding events with their process sources to drive the reduction of uncertainty, collection of information and measurement of the controls’ effectiveness. The degree of risk from people, external environment, systems, processes and relationships is explored.

5. Uncovering risks - Degree of quality and penetration coverage of risk assessment activities in documenting risks and opportunities. Degree of collecting knowledge from employee expertise, databases and other electronic files (such as Microsoft® Word, Excel®, etc) to uncover dependencies and correlation across the enterprise.

6. Performance management - Degree of executing vision and strategy, working from financial, customer, business process and learning and growth perspectives, such as Kaplan’s balanced scorecard, or similar approach. Degree of exposure to uncertainty, or potential deviations from plans or expectations.

7. Business resiliency and sustainability – Extent to which the ERM Process’s sustainability aspects are integrated into operational planning. This includes evaluating how planning supports resiliency and value. The degree of ownership and planning beyond recovering technology platforms. Examples include vendor and distribution dependencies, supply chain disruptions, dramatic market pricing changes, cash flow volatility, business liquidity, etc.

Understanding Enterprise Risk Management In-Depth

In today’s blog, we will discuss “Understanding ERM In-Depth; Using the Right ERM Strategy as A Catalyst for Addressing Risk, While Improving Audit Outcome”.

Companies are under significant pressure to stay abreast of a wide array of business risks that may impact their organization’s success and sustainability. BODs and senior management’s risk oversight role is becoming as critical to the sound running of an organization, especially for companies with significant market risk exposures. This has caused BODs and corporate officers to become more involved in strategic ERM planning at early stages, rather than just reviewing and signing off on an ERM strategy after it has been fully developed by management. Furthermore, the increasing demands and high expectations from the BOD levels have caused a major shift in how audit committees and chief audit executives approach their internal audit programs. Internal auditors are encouraged to incorporate a risk-based approach to internal controls auditing.

ERM Framework and Strategy:

I’ve seen many clients undergo major efforts in developing an ERM framework that work for their business. Most of these frameworks, in my opinion, appear to be nothing more than an over-engineered process that could have been completed with a COSO-based or NIST-based ERM framework. Bottom line here is to take advantage of frameworks that have already been established so that you are not “re-inventing” the wheel. Your ERM framework should capture ALL key and critical business areas within your organization. Your framework should also account for both, business and information risks. Key word here….ENTERPRISE!

ERM and Internal Audit:

The role of the internal auditor and the internal audit process is quickly changing. Today, internal auditors are encouraged to take a risk-based approach to their audit programs. I am working with a particular client where they are using risk composites to drive or “trigger” their audits. The way it works is that when both the likelihood and the MOI (magnitude of impact) of the threat are equally high, the audit department is notified to audit the control(s) that are supposed to mitigate the risks or threats. As an auditor, I strongly encourage that your audit team employ a risk-based approach to your audit strategy. Additionally, getting integrated with your ERM division offers great rewards in this process. This strategy will also improve your audit outcome. Know the risk….employ the effective control(s)….mitigate the risk….you get the idea!

ERM and GRC (Governance, Risk, and Compliance):

I had a customer ask me. “What is the most critical component of the GRC Process”? Although this is a tough question and every component of the GRC process is important, it is my opinion that cornerstone of GRC is risk (R). Without knowing and understanding the risks that businesses face today, it would be difficult to provide BODs with risk oversight, identify controls that need continuous monitoring, and achieve a risk-based approach to compliance management. Once your risk appetite has been determined and your business risks have been identified, you can perform risk analytics and modeling to further enhance your ERM program and provide BODs and corporate officers with oversight of their enterprise risks. All in all you can see the importance and significance of ERM within a GRC or corporate governance strategy. I’m curious to hear other approaches to this thought.

I would like to hear your views on the following:

1. What is your approach to Enterprise Risk Management?
2. How do you incorporate risk into your GRC or Corporate Governance Strategy?
3. What ERM framework works best for your organization?

Thank you

James Sayles
MBA, BS, CISSP, CISA, CISM
Vice President, Chief Risk and Compliance Officer
Favored Solutions

Data Theft

In today’s blog, we will discuss the issues concerning insider data theft and the selling of customer data. I would also like to hear your views on information risk management. Enjoy!

Over the last couple of years, insider data theft has become an major issue that companies are dealing with and seeking preventative controls. Even more shocking, some employees and contractors that have access to customer information have managed to make extra income in selling this information to the “electronic black market”.

The Issue:

The FBI has cited that 85% of data theft is caused by internal employees that have access to confidential data. In the month of July alone, two major data theft cases made headlines. Certegy Check Services, a subsidiary of Fidelity National Information Services, has announced that it has discovered that an employee sold identifying data on 2.3 million customers to a data broker and, more recently, a subcontractor working for a company that processes and fulfills orders for the Disney Movie Club sold credit card numbers and other account information belonging to an unknown number of customers to undercover law enforcement agents. The data stolen in both cases contained names, addresses, birth dates, and account information.

The Consumer Data Black Market:

The following types of information are being sold in the black market as follows:

• $980-$4,900 - Trojan program to steal online account information
• $490 - Credit card number with PIN
• $78-$294 - Billing data, including account #, address, Social Security number, home address, and birth date
• $147 - Driver's license
• $147 - Birth certificate
• $98 - Social Security card
• $6-$24 - Credit card number with security code and expiration date
• $6 - PayPal account logon and password

Major Cause of Data Breach:

Nearly fifty percent of professionals take corporate data with them when they changed jobs, according to a recent online survey, with many of them simply e-mailing it to themselves or storing it on a peripheral device. In fact, a CSI/FBI survey reported that the most serious financial losses occurred through theft of proprietary information. Much like other security vulnerabilities, non-malicious errors—otherwise known as social engineering—contributes largely to the problem. The leading cause of a data security breach is non-malicious employee error (39 percent), followed by malicious employee activities (30 percent) and hacker or external penetration (16 percent). Other data breaches include:

• Stolen Laptops
• Social Engineering
• Dumpster Diving
• Information left on printing and fax devices

Some Solutions:

Once the initial identification and classification of sensitive data has been determined, one can implement a number of automated methods to maintain these classifications. Linguistic signatures or forensic-based “file crawlers” can watch and sustain classifications as the original files change and new files are added to protected directories. These devices can be configured to navigate through file systems to watch protected files and directories in a number of ways:

• Protect and watch specific files. As the file contents change, so will the data in the signature repository.
• Protect all contents of a directory. File crawlers can be set to watch and protect directories containing proprietary source code.
• Protect all files matching a specific template within a directory. As file names and content within documents change all drafts of the document are protected.
• Protect all files with a given extension in a directory. For example, selecting the .xls extension enables protection for all Excel spreadsheets in the finance department’s directories.

Other solutions includes notifying departments to new threats and risk areas, it enables them to fully understand the cause of the threat thus allowing them to determine how to mitigate it; implement new controls; and then apply that knowledge to other areas. Finally organizations should review the following file system security components and implement security controls to mitigate the risk of data theft:

• File System Permissions
• Access Management and Frequent Monitoring/Review
• Network Access Management
• Hardened Systems and Hosts

In Closing:
In order to minimize the risk of data theft, organizations should consider the following approaches:

• Risk Assessment (RA): Organizations must periodically assess the risk to organizational operations
• System and Information Integrity (SI): Organizations must: (i) identify, report, and correct information and information system flaws in a timely manner; (ii) and (ii) monitor information system security alerts and advisories and take appropriate actions in response.
• Personnel Security (PS): Organizations must: (i) ensure that individuals occupying positions of responsibility within organizations (including third-party service providers) are trustworthy and meet established security criteria for those positions; (ii) ensure that organizational information and information systems are protected during personnel actions such as terminations and transfers; and (iii) employ formal sanctions for personnel failing to comply with organizational security policies and procedures.
• Physical and Environmental Protection (PE): Organizations must: (i) limit physical access to information systems, equipment, and the respective operating environments to authorized individuals

I would like to hear your views on the following:

1. IT risk assessment strategies; what is your process and approach?
2. Have you made the transition from information security to information risk management?
3. How are you measuring information risks?
4. How does your information security governance strategy fit into your organization’s corporate governance process?

Thank you

COSO Enterprise Risk Management

BUSINESS PRESCRIPTION — COSO ENTERPRISE RISK MANAGEMENT:

Organizations are looking for a structured methodology that lets them quantify risk, establish risk appetite/tolerance, identify and prioritize controls, and establish a system of record to meet a multitude of legal and compliance obligations.

This is where COSO comes in. The COSO Internal Control Framework was originally authored in 1994 with the aim of establishing internal controls to manage operational efficiency and effectiveness, financial reporting reliability, and compliance with laws and regulations. The Internal Control Framework has received a lot of attention recently, as it is the approach most organizations are taking for Sarbanes-Oxley compliance and is recommended by the SEC and Public Company Accounting Oversight Board.

What has been lacking is a structured framework to build an ERM process upon that integrates and extends the Internal Control guidance. PricewaterhouseCoopers, working alongside a project advisory council, worked with COSO in developing this needed guidance. The result: the recent release of the COSO ERM framework.

COSO defines enterprise risk management as:
“Enterprise risk management provides a framework for management to effectively deal with uncertainty and associated risk and opportunity and thereby enhance its capacity to build value.”

The COSO framework provides an answer to the challenges organizations are facing in governance, risk, and compliance. This framework’s goal is to build a risk management process as a foundational element of business operations.

The Evolution Of Technologies And Tools In Support Of COSO ERM

Sarbanes-Oxley (SOX) was the primary driver in providing a wake-up call within organizations for a consistent and defined structure to ERM.

Facing Section 404 compliance, organizations turned to documenting accounting controls in spreadsheets of SOX-specific solutions. Organizations have now become aware that a broader approach to risk and compliance management is needed. This results in a shift in the approach and tools needed to document risk, compliance, and internal controls. Neither the spreadsheet approach nor specific SOX tools are enough — organizations now need tools that can document and manage risk and compliance to the broader risk and compliance demands the organization faces.

SOX vendors, such as OpenPages and Paisley Consulting, are quickly expanding their tools to become broad enterprise risk and compliance management platforms. Others, particularly Axentis, provide an enterprise risk and compliance management platform already — including SOX compliance — and are among the first to integrate the COSO ERM framework into their solution.

Vendors in the SOX segment will face increasing demand for broader enterprise risk and compliance management capabilities — those that are to narrowly focus are likely to falter.

(COSO is the Committee of Sponsoring Organizations of the Treadway Commission. It is a cooperative effort between the American Institute of Certified Public Accountants, American Accounting Association, the Financial Executives Institute, the Institute of Internal Auditors, and the Institute of Management Accountants. Further information on COSO and the Enterprise Risk Management framework can be found at http://www.coso.org.)