How Compliance Leaders Can Prepare Companies for Audits
Payment Card Assessments | Compliance and Certification | Education | Healthcare Assessments
NOTE: Schellman has since updated and expanded on this information in an article here.
Nobody likes a compliance audit, but they serve a necessary purpose in the business world. If an organization is lacking in its adherence to global compliance regulations, there could be serious fallout. Employees or customers may lose trust. Your company’s reputation could be damaged, and worse — lawsuits and fines can significantly damage financial health. For this reason, chief compliance officers must change the way they think about audits. Painstaking as they may be, an audit provides you the opportunity to rectify issues before they become larger problems. Instead of dreading and avoiding an upcoming audit, here’s how compliance leaders can prepare their company to make the review process less agonizing.
Know Your Industry
Be aware of all the specific regulations associated with your industry, not just the most obvious. Furthermore, gain an understanding of whether your company is up-to-date in its compliance with each. Common regulations include:
- The Federal Health Insurance Portability and Accountability Act (HIPAA)
- Gramm-Leach Bliley Act (GLBA)
- The Federal Information Security Management Act (FISMA)
- Payment Card Industry Data Security Standard (PCI DSS)
- The Sarbanes-Oxley Act (SOX)
Know Your Network
Understand the key systems involved in your company’s infrastructure and the critical systems necessary to provide services to your customers. This will play a critical role in determining which regulations that require compliance. Get organized by creating data flow charts for each key business process to ensure you understand how information is shared and protected within your company’s network.
Review Past Audits
Previous compliance issues that repeatedly go unresolved are an indication that the controls may not be functioning as intended or by the correct department. Identify these recurrent issues and figure out why they continually reappear to create a smoother audit next time around.
Have a Game Plan In Place
If any compliance issues are detected in your audit, you’ll want a plan in place to correct them — fast. Know ahead of time how you will prioritize, manage, delegate and execute resolution. It’s also important to consider how these efforts can contribute to continuous improvements in your company’s adherence to regulatory guidelines.
Communicate Clearly With Your Auditing Firm
The only thing worse than an audit is one that seems to last forever. Be forthcoming about the needs of your company, and confirm that the auditing firm understands how to properly field any difficulties that arise during the audit, which could inhibit their ability to reach key progress points.
Make Your Audit Work For You
Compliance audits cost money. To minimize the expense, use them as an opportunity to refine the way your company operates. Consider how you can use the insight provided by the audit to increase revenue, cut costs and better manage risk.
Preparation is the key to a painless audit. With proper foresight and planning, audits don’t have to be arduous, painful reminders of your company’s compliance shortcomings. They can be useful tools that provide invaluable insight into how your company can improve its operations to strengthen bottom line, fortify trust and reputation, protect itself from costly security gaps and compete in today’s increasingly regulated marketplace with confidence.
About DEBBIE ZALLER
Debbie Zaller is Chief Operating Officer at Schellman. Debbie is responsible for maintaining and driving operational results and executing the firm's strategic goals. Debbie oversees all daily operations of the firm while spearheading the development, communication and implementation of effective growth strategies and processes. Debbie has over 21 years of IT compliance and attestation experience. Debbie led the firm's Midwest, Southeast, and Northeast regions along with the national service lines of SOC 2 and Privacy service lines as Managing Principal before assuming the position of COO in 2021. Debbie holds a Master of Accounting degree from the University of Florida. She is a Certified Public Accountant, Certified Information Privacy Professional/United States, Certified Data Privacy Solutions Engineer, Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified Cloud Security Knowledge. She is currently an AICPA-approved and nationally listed SOC Specialist and speaker on various privacy topics. Debbie was on the AICPA Task Force for the Advanced SOC for Certification Exam, was a member of the Florida Institute of Certified Public Accountants Board of Governors and served on the Finance and Office Advisory Committee.