WHAT FINANCIAL EXECUTIVES ARE ASKING ABOUT IT AUDIT AND RISK MANAGEMENT

1. WHAT FINANCIAL EXECUTIVES ARE ASKING ABOUT IT AUDIT AND RISK MANAGEMENT Institute of Internal Auditors – LI Chapter Annual Information Technology Conference May 10, 2013

2. Joel Lanz, CPA/CITP, CGMA, CISA, CISM, CISSP, CFE Prior to starting his practice in 2001, Joel was a Technology Risk Partner in Arthur Andersen’s Business Risk Consulting and Assurance Practice, and was a Manager at Price Waterhouse. His industry experience includes Vice President and Audit Manager at The Chase Manhattan Bank and senior IT auditor positions at two insurance companies. He currently is an Adjunct Professor in the School of Business at The State University of New York – College at Old Westbury. He teaches graduate courses in Auditing, Advanced Assurance, Forensic Accounting ,Accounting Information Systems and Accounting Research. Joel is the Chair of the AICPA’s Certified Information Technology Professional (CITP) Specialist Credential committee, and serves on the Institute’s Cybersecurity, Forensic Technology Task Force. He co-chaired the 2010 and 2011 Top Technologies Task Force and previously served on the Institute’s IT Executive and CITP Credential Committees Joel is a member of the Editorial Board of “The CPA Journal.” Joel previously chaired both the New York State Society of Certified Public Accountants Technology Assurance and Information Technology Committees. He also serves on the Institute of Internal Auditors – Long Island Chapter Board of Governors.

3. SESSION DESCRIPTION • In this fast paced presentation closing our annual technology conference, Joel Lanz, who authors a monthly technology question and answer column for the New York State Society of CPAs “Trusted Professional” newspaper will discuss IT Audit and Risk Management issues frequently on the mind of the newspaper’s over 30,000 financial executive readers.  Highlights of this year’s most popular columns will be reviewed providing participants with a briefing on key IT Audit and Risk Management areas. He will review sources of information that can be used by these Financial Executives and their Internal Auditors in trying to identify appropriate areas of interest so that they can add relevant value to the organization. 

4. WHAT IS THIS MONTHLY COLUMN THAT YOU ARE TALKING ABOUT? THE TRUSTED PROFESSIONAL TECH Q&A FOR TODAY’S CPA Monthly column addressing key IT Risk Management and Audit Issues – yet sometimes we discuss “the little technology challenges” that are faced on a daily basis. Joel responds to reader questions about technology and the role of financial executives in managing information risk. Usually each column addresses 2-4 questions and comprises 1000 words. • Is the voice of the New York State Society of CPAs (NYSSCPA), keeping readers up-to-date on legislative, regulatory and administrative developments, particularly as they concern tax and audit policies and accounting practices of New York State. • The publication serves members of the NYSSCPA by providing in-depth coverage of NYSSCPA news and insight into key issues and changes affecting New York CPAs and information on regulatory and ethical standards of the profession.

5. SO, WHAT’S ON THEIR MINDS? NO SURPRISES HERE • Information Security • Privacy Risk Management • Managing IT Vendors and Partners • Cloud Computing

6. IT’s IMPACT ON CLIENTS • WE SHOULD NOT HAVE BEEN THAT SURPISED – BUT – THE ROLE OF THE FINANCIAL EXECUTIVE (CPA) IN MANAGING OR ADVISING CLIENTS ON IT OPERATIONS AND FINANCE WAS GREATER THAN EXPECTED. • BYOD Policy Challenges • Preparing the IT Budget • Managing the IT Department • Updating the Business Continuity Plan

7. “MORE THAN” SOMEWHAT SURPRISED • Access vs. Excel • How to integrate IT Audit • How to Secure a Microsoft Word Document

8. The recent Internet Explorer scare raised a number of issues related to patch management.  What do my clients need to know about patch management? • Many information security practitioners believe that an appropriate patch management is one of the most critical protection strategies that companies and personal users can employ to reduce logical security threats. • To know what to patch, users must be aware of what is on their system. • Microsoft provides a utility, Windows Server Update Services (WSUS) that according to the Microsoft website enables information technology administrators to deploy the latest Microsoft product updates to computers that are running the Windows operating system. • Alternatively, companies will use an automated vulnerability scanning tool such as Nessus (Tenable Network Security) or Qualys to help identify required patches.

9. A number of my clients have implemented a “Bring Your Own Device” (BYOD) program to help their employees manage the number of handheld devices as well as reduce expenses for the businesses. Should I adapt a similar program for my practice? • As with so many other things in business, the answer is it depends. Companies have implemented BYOD programs in response to the “consumerization of IT.” • So in implementing BYOD programs, companies are trying to respond in a timely manner to the introduction of rapidly developing technologies adapted by the consumer sector (e.g.,employees) but have yet to be – or are not being adapted by business or corporate IT (e.g., Tablets). • As with many other technology-related decisions a lot is going to depend on which industry you are in and the extent of regulatory requirements that need to be addressed to protect confidential and non-public information. • CIO Magazine has produced “The Consumerization of IT and BYOD Guide” (http://www.cio.com/article/705880/The_Consumerization_of_IT_and_BYOD_Guide) that provides a very useful toolkit in evaluating the issues.

10. What are some of the key issues that should be included in our IT vendor management oversight efforts? • Depending on the particular business and the industry it serves, each IT vendor represents a different risk to the business, and due to the reality of resource constraint faced by all businesses efforts will need to be prioritized. • Appropriate contract provisions including specifying expectations as to service delivery and right-to-audit are key. In many, but not all situations, a thorough review of the IT Vendor’s Service Organization Report (especially SOC 2) can facilitate the review. • Preparing contract abstracts summarizing key contract provisions can also help with oversight efforts. Understanding IT vendor plans for security breaches and business continuity can also help determine that the IT vendor will facilitate business operations in a crisis situation. • The Defense Contract Audit Agency’s “Contract Audit Manual” available at http://www.dcaa.mil/cam.htm to be an excellent source of ideas

11. I’m getting ready to prepare/review the IT budget for next year – what should I be considering? • In many ways, although complex, budgeting for IT does not differ materially from budgeting for other significant business investments and expenses. • Based on my reviews of IT budgets, I continue to find that implementing basic financial discipline can go a long way in identifying “excess” resources. For example appropriately planning for infrastructure maintenance, including the impact of changes to architectures including but not limited to cloud computing, confirming contract compliance and use of technology paid for, and reducing the complexity and variability of technology used. • Perhaps most important, is that financial people should not be intimidated by the vocabulary used in IT budgeting and do what is needed, to obtain the understanding of issues represented in the budget to fulfill their financial responsibilities.

12. I’m the controller for a “midsize” distribution company and have just been assigned responsibilities for the Information Technology function. What question should I be asking? • Is the effectiveness of provided services accumulated and monitored? • Is the IT function appropriately placed within the organization and does the function have the necessary leadership and management assets to satisfy and deliver upon executive management expectations? • To what extent have financial management practices been implemented by IT (e.g., managerial finance issues including ROI for new projects and key investments). • Are critical applications and “core” application systems effectively implemented within the business area and are system features utilized to the extent possible to enhance the ability of business users of the system to achieve their objectives? • Is IT risk being managed to an acceptable level given the business objectives identified above?

13. It’s been awhile since we reviewed our business continuity plan.  Any suggestions to jumpstart our efforts? • BCP is on the agenda of most business leaders, but due to other pressing concerns does not receive the urgency or funding to help ensure that appropriate plans are developed, implemented and maintained. • BCP is a business issue and includes significant decisions that go beyond information technology concerns. • Being able to recover data does not mean that you would also be able to reroute your telecommunications capability to a different facility that will now house your business. • The Federal Emergency Management Agency (FEMA) through its Ready.gov website provides significant guidance and tools to help facilitate this process. Of particular note is the “Business Continuity Planning Suite” available at http://www.ready.gov/business-continuity-planning-suite.

14. When to use Excel vs. when to use Access? • For many practitioners the response to this question has more to do with their familiarity with the applications rather than the features themselves. • New versions of Excel have significantly increased the analytical capabilities and presentation of financial analysis including the use of Pivot Tables, statistical techniques and graphing/charting tools. • Access is a more sophisticated application that is better suited to managing information. • Access requires a more disciplined approach as the various relationships within the database need to be defined during database design and generally provides less flexibility for modification than does Excel. • Access can also provide a report of all actions taken on the database including the types of queries that were run.

15. How can we effectively leverage IT Auditing into our audits? • Firms of all sizes face the challenge of how technology needs to be assessed, and how to translate technology risk into the audit decision. • Remember it's all about understanding and addressing the risk in an effective and efficient manner. Don't get confused with the technical jargon involved. Obtain a sufficient understanding of IT so you can determine how it impacts the audit risk model. • Assess whether the IT controls are in place and functioning so that you can adjust your overall testing in accordance with the audit risk model.

16. How can I secure Microsoft Word documents? • Although this question appears to be simple, it's answer is quite complex. • Basic protection includes the use of password and encryption features within word. • Avariety of access permission options including encrypted the document with a password and limiting further distribution of the document. • In addition to access privileges, another major threat is the unintended use of the metadata that is contained in the document.

17. BONUS SLIDE(“December Stocking Stuffers”) • What should I be reading to enhance my skills? • “IT Risk”, by George Westernmen, Harvard Business School Press, 2007. (General IT Risk Management). • “The Adventures of an IT Leader,” by Austin, Nolan and O'Donnell, Harvard Business School Press, 2009. (CXO and Leadership). • “The Art of Intrusion,” by Kevin Mitnick, John Wiley & Sons, 2005. (Information Security and Fraud Prevention). • “Forensic Analytics,” Mark Nigrini, John Wiley & Sons, 2011. (IT Audit, Computer Facilitated Fraud Prevention and Detection) • “The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes “, Cappelli, Moore and Trzeciak, Addison-Wesley Professional, 2012. (IT Audit, Information Security, Fraud Prevention and Risk Management). • A Practical Guide to Reducing IT Costs, Cassidy and Cassidy, J Ross publishing, 2010. (CXO and Financial Managers).

18. FOR FURTHER INFORMATION • Contact Joel directly at: Joel Lanz, CPA/CITP, CFF Joel Lanz, CPA, P.C. 471 N. Broadway-pmb 395 Jericho, NY 11753 (516) 933-3662 jlanz@joellanzcpa.com www.joellanzcpa.com • Visit www. joellanzcpa.com for related articles and other related presentations