By reviewing application vendor contracts and analyzing invoices, $350K was saved. Cost was further reduced as process improvements, standards & best practices were put into place and vendor findings turned into negotiating leverage for contract renewals.

A duplicate invoice payment search script was developed in Excel using SAP vendor invoice data that allowed a Vendor Audit team to easily discover and collect over $3M in the first 2 years of operation.

Critical Workday access issue discovered that had been an approved work-around solution in place for 3 years, but not documented or communicated. It was not previously identified because the work-around utilized a different type of user account, normally associated with non-Production environments. Simply put, no one had looked beyond the norm of Production access testing or asked the right questions. Once identified, mitigation ensued with a securely configured solution and documented workaround (along with additional SOX testing for assurance!).

Determined to make SOX testing more efficient, automation options were discussed with several members of IT. To minimize development time (& keep it simple), I worked with the SharePoint Admins to develop the necessary workflows, and led project efforts until we had a working model. The first year likely didn’t save much time, however we learned from it. After further refining the process and working with app owners to gain their support, more time was saved the second year than expected. The efficiency continued as the automated workflows became a normal part of the SOX testing process. Similar automation was implemented later at another company using Alteryx and Power BI.

● Identified IT assets, performed risk assessment

● Defined the audit universe, and developed 3-year, risk-based IT Audit Plan

● Introduced IT Auditing to Executive Management with a document defining the process & audit universe, including it as a precursor to the IT Audit Plan (as requested by the IA Director).

● Overcame the challenge of being the first IT Auditor, developing relationships with IT & business personnel built on trust and mutual respect.

● Successfully passed regulatory compliance audits (i.e. SOX, HIPAA, PCI) and performed IT & OT technology audits focused on adding maximum value.

Non-IT, Internal Auditors were included in IT Audit projects whenever possible for cross-training & experience. Over time, this helped increase our team’s capabilities & overall audit efficiency. This was especially helpful for high-frequency audits involving applications, cybersecurity, and SOX compliance.

In preparation for first-time Linux Server Standards audit, installed home Linux workstations with various Linux flavors. Then, used CIS Baselines to write and test scripts, identifying key access, configuration and security information as needed to help determine level of system hardening standards. While primarily done to learn & prepare for the audit, these efforts were key in building rapport and gaining support of the Senior Linux Admin, who tested, and even improved the scripts, ultimately helping to make the audit more effective.

Having worked in IT and been ‘on the other side’ of the audit as the person responsible for SOX compliance, I’ve been through both the challenges and successes in IT, including responding to audit requests, problem-solving, risk mitigation, and everything in-between.

Therefore as the auditor, I always treat others the way I would want to be treated, doing my very best to listen, foster understanding, and focus on balancing controls with business, security & compliance needs.

While working with our Internal Audit team on a ‘routine’ company business unit audit, research & follow-up on a potential application issue turned into a full IT application audit, noting critical vendor risk. After prompt communication with Executive Management, action promptly ensued, working with IT & Cybersecurity in resolving immediate issues as well as developing a long-term solution. This action resulted in averting a business disaster that would’ve occurred just a month after it was discovered.

As a special project, IT Service Delivery risk was planned for review to add assurance by determining if any changes in risk had occurred over the previous year. After identifying key process areas and related metrics, Service Delivery application data was successfully downloaded in Excel to verify documented KPI’s/KRI’s, and compare & chart YoY trending. The process was then automated with app data queried directly in Excel to provide an efficient, effective solution for risk reviews and the audit program.

Cloud computing audit program developed based on CSA’s Cloud Computing Matrix (CCM), NIST 800-53 Security and Privacy Controls for Information Systems, and Organizations, and experience of having learned where common control issues are often identified. The program also goes further, reviewing third-party vendor contracts & SOC reports including historical information and the procurement process itself.

Worked with the IT Director and project team, utilized the COBIT Framework and a common sense approach, and identified opportunities for improvement as needed for the next phase of the migration project. Once communicated, mitigation promptly ensued. A follow-up audit review verified project enhancements, and greatly helped with the overall success of the project.

Collaborated with the IT Security team and met with app owners & business management prior to audit to foster support. Many similar high risk control issues were identified and mitigated, leading to increased user awareness and security. This project also strengthened relationships, especially with business app process owners, many of whom continued to ask questions and provide updates on noted app issues or potential vendor concerns.

Developed presentation and performed training for business SaaS solution app process owners (and even some IT app owners!) as needed for awareness, understanding and implementation of a common SOC report review, approval, & escalation process for any issues where further discussion may be warranted. This process often improved with time including automated workflows.

…

…

…

…

…