Tools

The following tools were published on KnowledgeLeader this week:

Entity-Level Controls Audit Work Program

Our Entity-Level Controls Audit Work Program serves as a comprehensive guide for evaluating the entity-level controls within an organization, ensuring compliance with the Sarbanes-Oxley Act (SOX) requirements. It provides auditors with a structured framework to assess the effectiveness of internal controls that impact financial reporting and legal compliance. It begins by outlining the audit objectives, emphasizing the importance of evaluating the control environment, risk assessment processes, information and communication systems, control activities, and monitoring mechanisms. These elements are crucial in fostering a robust control environment that upholds integrity, ethical values and management's commitment to competence. 

IT Strategy Management Audit Work Program

Our IT Strategy Management Audit Work Program is an essential tool for evaluating the effectiveness and alignment of your organization's IT strategy with its business objectives. This robust audit work program assists in identifying potential risk indicators such as competitive gaps, IT budget overruns and high executive turnover. It outlines critical areas for assessment, including the appropriateness of IT infrastructure management, IT's role within the company, flexibility and responsiveness to change, stability and reliability, communication processes, technology leverage, results management, and human capital.

IT Help Desk Audit Work Program

Ensure a smooth and efficient IT help desk process with our sample work program. The program outlines critical tasks such as assessing management's evaluation of user support, identifying help desk customers, and analyzing the staffing adequacy relative to user needs. Additionally, it emphasizes the importance of technology leverage, encouraging the examination of using help desk software for tracking and reporting issues.

Security Management Audit Work Program

Our Security Management Audit Work Program serves as a structured framework for conducting comprehensive security audits, focusing on the evaluation of information security programs. It outlines essential steps in the audit process, including planning, information gathering, vulnerability assessment and risk evaluation. The work program includes five samples, each targeting specific aspects of security management. Sample 1 emphasizes the evaluation of existing policies, procedures and controls designed to protect information assets. It includes preliminary steps such as scheduling meetings and detailed execution steps that assess various control areas, ensuring that security policies are effectively communicated and adhered to throughout the organization.

Employee Selection Process Policy

For the most effective and beneficial results, organizations should have a defined and documented employee selection policy describing the process as a whole, as well as specific steps that are necessary to be completed. This policy is helpful as a referral guide for all of the personnel that play a part in employee selection. The document provides a detailed overview of various steps involved, such as pre-employment screening, application processing, selection testing and interviewing.

Publications 

KnowledgeLeader has also published several publications this week.

Executive Perspectives on Top Risks for the Near- and Long-Term: Aerospace and Defense Industry Group Results

Protiviti’s 13th annual Executive Perspectives on Top Risks Survey focused on the global aerospace and defense (A&D) industry group for the first time. The findings indicate that this industry is in a period of profound transformation driven by mounting geopolitical tensions, technological change and disruption, shifting economic priorities, and evolving workforce dynamics. In this report, we reveal the top risks A&D executives should consider moving forward, based on the results of the survey.

Former CISO on What Boards Are Getting Wrong About Data Protection and Privacy

Sue Bergamo is an executive advisor, former CIO, CISO and global technology strategist for Microsoft. She sits on several boards, is the host of the Short Takes podcast and author of So You Want to Be a CISO: A Practical Guide to Becoming a Successful Cybersecurity Leader. In this interview, Joe Kornik, editor-in-chief of VISION by Protiviti, and Bergamo discuss recent SEC rulings and their impacts on the current and future state of the CISO role, how the C-suite and boards view data governance and privacy, and what steps they should be taking right now to build customer trust.

Third-Party Resilience: Increasing Transparency

The financial sector’s interconnectedness to and reliance on critical third parties continue to create significant dependencies as risks evolve. As part of their risk mitigation efforts, financial institutions will need third parties to demonstrate advanced resiliency capabilities. The standards identified in this paper represent what these firms should consider meeting to serve financial institutions effectively.

Recommended Resources 

This list of recommended resources from the web may be of interest to you. Click each link to learn more. 

1. Prop. Regs. Address 401(k), 403(b) Automatic Enrollment Requirement
2. Advising Boards on AI-Related Disclosure and Governance Obligations
3. How CFOs Can Negotiate Employee Benefit Costs