Challenge
A publicly traded media company had to show its auditors each year that its technology was controlled: who could access financial systems, how changes were approved, how data was backed up.
It also depended on outside providers, and had to review their control reports and act on what they found.
Approach
We ran IT to a standard that could be evidenced, and kept the evidence.
- Document the controls for access, change and backup.
- Collect evidence that each control operated through the year.
- Review the control reports of outside service providers.
- Record exceptions and what was done about them.
- Prepare the documentation ahead of each audit.
Result
The company went into each audit with its IT controls already written down and evidenced.
- Less disruption during audit season.
- Service providers held to account.
- Controls that staff actually followed.
Our advice
Controls are easier to follow than to reconstruct. Record the evidence as the work happens, and the audit becomes a matter of handing it over.
Related service: IT security & penetration testing.