This is an audio version of a blog article.

The original article was published here:
www.riskinsights.com.au/blog-1/supply-chain-risks

In this episode, we explore three newer supply chain risks – two that relate to being associated with questionable suppliers, and a third that relates to fraud.

The symantec guidance: Business email compromise

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit riskinsightsblogcast.substack.com

Hosted on Acast. See acast.com/privacy for more information.

This is an audio version of a blog article.

The original article was published here:
https://www.riskinsights.com.au/blog-1/openaccess


More access to data to reduce risk and enable better decisions

Controls are usually put in place to reduce risk.

Like user access controls to reduce data integrity risk.

But what if your access controls are actually increasing risk?

This can happen - particularly if there is no distinction made between systems of record (like ERPs) and systems of intelligence (like data warehouses).

In this article, we discuss an alternate approach.

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit riskinsightsblogcast.substack.com

Hosted on Acast. See acast.com/privacy for more information.

This is an audio version of a blog article.

The original article was published here:
https://www.riskinsights.com.au/blog-1/sas70-certification-and-other-soc-report-myths

SAS70 certification and other common SOC report myths

If you use or plan to use a cloud/SaaS/hosted solution, how do you ensure that the service provider is protecting your systems and data?

Rely on their SAS70 reports, right?

Not quite.

In this article, we explain why this is not the right answer and explore a few other common myths.

Background

System and Organization Controls (SOC) reports used to be conducted in accordance with "SAS70" in the US.

A few years ago, SAS70 was replaced by:

• In the US: SSAE18, now replaced by SSAE18.
• Globally: ISAE3402.
• In Australia: ASAE3402.

For audits that are conducted in accordance with these standards, a SOC report is produced.

SOC 1 Myths

1. Certification or compliance - Myth: The outsourced service provider is certified or compliant. 

2. Qualified Opinions - Myth: A qualified SOC report is the same as qualified financials, which is bad. 

3. Use of SOC 1 reports - Myth: The reports can be used to determine the level of control over all IT risks.

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit riskinsightsblogcast.substack.com

Hosted on Acast. See acast.com/privacy for more information.

This is an audio version of a blog article.

The original article was published here:
https://www.riskinsights.com.au/blog-1/5-data-in-audit-challenges

Five data in audit challenges, and how you can overcome these:

1. Access to data – you can't get all the data, or you can't get it quickly enough.
2. Low value – the analysis doesn't provide new insights.
3. False positives – results are overwhelmingly noisy, distracting your focus.
4. Superficiality – the results are not deep enough to properly understand and refine the problems or to provide opportunities for improvement.
5. Timing – the results are not available in time for reporting/concluding.

For more advice on analyzing data for audits, you can find The Data-Confident Internal Auditor on Amazon, with bonus resources available at data-confident.com. 
The book aims to demystify the use of data in internal audits through practical, step-by-step guidance. 

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit riskinsightsblogcast.substack.com

Hosted on Acast. See acast.com/privacy for more information.

This is an audio version of a blog article.
 
The original article was published here:
https://www.riskinsights.com.au/blog-1/3-analytics-software-sets-for-your-team-and-3-selection-advice-considerations
 
In this episode, we outline the 3 types of data and analytics software that audit teams should have access to, at a minimum. We also explore 3 questions to ask if you are obtaining external advice regarding software selection.

Link mentioned in the article: ASAP Utilities – an excel add-in.

For more advice on analyzing data for audits, you can find The Data-Confident Internal Auditor on Amazon, with bonus resources available at data-confident.com. 
The book aims to demystify the use of data in internal audits through practical, step-by-step guidance. 

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit riskinsightsblogcast.substack.com

Hosted on Acast. See acast.com/privacy for more information.

This is an audio version of a blog article.

The original article was published here:
https://www.riskinsights.com.au/blog-1/audit-data-governance

It explains, using a case study, why internal auditors and performance auditors need to consider adopting a specific approach to managing the data used on audits.

This is the 1st article in the DGIA (Data and analytics Governance within Internal Audit) series.

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit riskinsightsblogcast.substack.com

Hosted on Acast. See acast.com/privacy for more information.

This is an audio version of a blog article.

The original article was published here:
https://www.riskinsights.com.au/blog-1/complaints-data-audit

Why are auditors increasingly using complaints data?

Most auditors that use complaints data are interested in one or more of these three key benefits:

1. Customer complaints can provide an alternate perspective for a range of audits e.g., identifying revenue leakage like in the example above, triangulating customer requests that had not been acted on, highlighting control gaps.
2. Understanding complaints data enables audit to help management improve the complaints process e.g., how complaints are reported on. 
3. Exploring the complaints data enables audit to identify strategy achievement blockers – presuming that the strategy focuses largely on customers. For example, your complaints data may point to previously unidentified problems in how services are delivered.

 In this article we explore:

• the historical problem with using complaints data and why this is no longer a challenge
• what the data typically looks like – understanding complaints data
• another use case (triangulating customer requests that had not been acted on)

What the article doesn’t cover:

•  The third benefit above (strategy achievement blockers) – this is an interesting angle, but we’ll leave it for a future article
• Complaints data that is recorded manually e.g., handwritten notes in a physical file.  This is not impossible to analyse but converting the physical data to electronic data is a separate topic.  The solutions in this article assume that the data is already in electronic form.

For more advice on analyzing data for audits, you can find The Data-Confident Internal Auditor on Amazon, with bonus resources available at data-confident.com. 
The book aims to demystify the use of data in internal audits through practical, step-by-step guidance. 

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit riskinsightsblogcast.substack.com

Hosted on Acast. See acast.com/privacy for more information.