How do you optimize system audits and reviews?

In order to avoid multiple amendments to audit scope, we need to build an understanding with the auditee right at the start of the engagement that as long as the requested changes do not derail the timelines and the audit objectives , the changes can be incorporated. The best approach would be to add this as a clause in the legal contract / SOW.

With evolution of technology, systems and processes, the Audit methods also need to restructured to ensure a complete independant assessment and assurance. While standard processes such as Audit charter, audit scope, evidence collection & validation , verification do exist, what is needed to an "Agile Approach" to these phases to ensure Audits are dynamic in approach and changes to scope or approach can be accommodated. So to make audit effective - Define audit objective (based on considering regulatory compass, legal risks, data CIA, critical business processes), collaboration schedule with key stakeholders, At least weekly standup update, RFI collection& delay escalations, reporting (Executive, NCs , remediation timeline, revalidation)

From an auditee perspective the challenge I have is getting the correct information from other groups i.e. security. A pet peeve of mine is not having procedures documented. When I require information for an audit I want to be able to contact anyone in the group I need it from; I should not have to contact a specific individual. Unfortunately, these procedures are not often documented so it is sometimes difficult to get in a timely manner due to the "how" being in someone's head and not on paper.

In a typical organization, not all stakeholders would be familiar with audit best practices and etiquettes. Its important conduct pre-audit workshops to set expectations in terms of - What systems would be covered [ including audit period] - What should audit asset inventory cover ? [ example HW, software, cloud systems, APIs - Review of any past audits and open issues - Initial system walkthrough sessions by system owners for auditors - How should audit queries or RFIs to be documented and reported within defined timelines ? - Audit scope, charter, Key SPOCS for auditors to work with including backups - Regulatory aspects, recent changes to technology or processes - Auditee interviews guidelines - Sample reports - Scope exclusion

Audit is review of data in a defined period i.e.collected for an independant review for potential violations and frauds. Lets say audit scope is review of retail banking application for FI for 2022(Jan - Dec), its important for auditor to get - Accurate inventory of associated systems, apps - Data of all transactions, users, access reviews, change requests, AV repots, system configurations, security mgmt practices etc on all these systems - To make audit non-intrusive, get data in xls,csv type of formats for query mgmt. Using powerBI or Tableu, auditors can pick up samples for review and find exceptions - Conduct in-person or video interviews( with consent) with auditee to understand processes - Prepare interview questions in advance

Prior to documenting final reports, discuss with key stakeholders for accuracy, impact of risks, reasons/plans for remediation, accountablity/ownership and mechanisms for re-validating audit remediations. Few things to consider, - Keep audit report extremely simple, easy to understand with clear directions (Example - Audit scope / Timelines / Audit finding / description / Risk Severity/ impact / suggested remediation could be key aspects) . - Report must be shared with all key leadership stakeholders and acknowledgment to be taken - Clearly highlight timelines for remediation (Example high risk issues to be fixed in 30 days) - Include any open issues that have not been fixed from pervious audits - Follow up on audit actions. Dont wait.

Audit report is the key document, that should lay out accountability and timelines for audit fixes. In the supplementary documents, do share audit data validation methods, artefacts, samples, tools you used - this build trust and transparency between auditor and auditee. Where available, use GRC systems for audit issue tracking and remediation. Give audit ratings (Satisfactor /good etc) with clear remarks. Where organizations do well, auditors must appreciate the good work in reports. Be honest and transparent. Post audit, do not forget to run a survey on how audit experience was and any recommendation including feedback on auditors conduct. Keep a Audit closure meeting to summarize action plan and announcing closure of the exercise.

Space contraints but brief examples. In my all Banking audits, traditional audit methods were like SDLC waterfall. We shifted to Agile audit where Audit scope was broken into sprint (action plans), audit was managed using centralized portal for RFI, reporting etc. Weekly 15 min-standup with auditors for quick progress catch up, updates with all stakeholders Audit schedule was managed using planner, each unit had identified audit co-ordinator as SPOC to avoid RFI delays Prior to audit we kept all minimum anticipated documents ready for audit review RFI depository was maintained to ensure repeat audits are managed efficienly more importantly, all key staff had "Audit performace" as one of the KPI in their appraisals.