practices. Internal auditors must also learn specific controls associated with a security or financial standard — a framework — that has been tailored to fit the organization’s business operations. Company management commissions and charters internal audits with senior managers setting the timeline, objectives, and scope for the audit team. The results of an internal audit are designed to closely mimic the findings that an external audit would produce, so there should be no surprises when an external audit occurs. Now it’s time for the external audit. It’s easy to get lost in forests of buzzwords, certifications, and claims made by audit firms. Here are some tips for a successful external audit that won’t freeze your blood.
By Steve Berman
Selecting an Audit Firm Senior management is in charge of this process, which includes engaging an audit firm. Don’t let outside influences overly affect this process; just because a key client or supplier uses a goldplated national audit firm doesn’t mean that your organization must also use them. Your organization is paying for the audit and the firm you engage works for you. Select them with the same care you would use for any other service provider. Check their certifications, references, and prior engagements. Ensure they possess the kind of experience with the same types of organizations as yours — we are in the mailing business. It will make life much easier if you don’t have to explain your business practices over and over to an auditor who is unfamiliar with the industry. For SOC 1 (financial control) audits, you want to ensure the firm will assign a licensed CPA to your engagement. For SOC 2 (security) audits, look for credentials like Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP). If you offer payments, you may want to select a firm that also conducts PCI-DSS assessments using a Qualified Security Assessor (QSA), even if you don’t sign up for the assessment. Finally, don’t be afraid to negotiate price. Interview several firms and let them know they are competing for your business. Even if you have used the same firm for years, it is a good practice to get a quote from a different firm now and then. In fact, many auditors recommend that you change audit teams every three to five years, just to ensure the company and audit firm don’t get into too comfortable a rhythm and overlook important items.
“The auditors are here!” Your blood runs cold, like seeing red and blue flashing lights in the rearview mirror. You needn’t worry. An external audit doesn’t have to incite fear and horror. In fact, the process can be affirming, a strengthening experience for service companies that deal with sensitive client data. In part one of this two-part series, we dealt with internal audits and best practices to conduct an effective assessment using company resources and staff (if you missed it, visit MailingSystemsTechnology.com/InternalAudits). Here, we will deal with external audits, which are conducted by independent professionals certified in their particular field of practice. Let’s review: Auditing is a process by which organizations and leaders learn how well policies and procedures are followed, how closely the company’s documentation describes actual practices and how effective those processes are in achieving organizational goals. Auditing is about measuring and testing — creating a good security, financial, or quality posture. Internal audits are conducted by a company’s staff, who have familiarized themselves with the policies, procedures, and
Scoping and Scheduling the Audit Most importantly, someone must be in charge of dealing with the audit firm. Do not overlook this. Many times, senior management will negotiate and approve the engagement and leave the “details” to underlings. Be sure to intentionally name someone on staff, and their backup, to be the liaisons and ensure the lead auditors meet those individuals as early as possible. Work with your audit firm and their team to determine the scope of controls they will be examining. If your internal audit team determined that a particular set of controls does not apply, share that with the external auditors. It wastes time and creates unnecessary confusion for the external auditors to request evidence for items you never intended to include in the scope. It is far better to resolve any conflicts before the audit. Schedule the audit with plenty of time for your team and their team to prepare. A rushed audit schedule is stressful, not just for you and your staff, but also for the external auditors. Go over the audit schedule with your team and the external auditors. Specifically, ensure milestones are established for “populations”
ARE YOU PREPARED FOR A SECURITY AUDIT? Part 2: External Audits
20
MAY-JUNE 2024 | MailingSystemsTechnology.com