The Schellman Blog

Organizations take different approaches when it comes to documenting their policies and procedures. Some prioritize keeping them well-documented and easily accessible to employees at all times. Others may only recognize their importance when planning and preparing for an audit as they conduct an extensive review of their existing documentation to determine if they meet audit guideline requirements. Meanwhile, there are companies that overlook or neglect the need for formal policies and procedure documentation altogether.

Although undergoing a SOC 2 examination is not a mandatory security framework and as such, is not a legal or regulatory requirement for every business, it is often considered a necessity for companies. This is especially true for organizations that regularly store customer data and handle sensitive information.

Effective January 1, 2002, the Institute of Internal Auditors (IIA) released updated standards in the International Professional Practices Framework (IPPF). Internal auditing departments, according to Standard 1312 of the IPPF, must complete an external assessment once every five years from a qualified independent assessor or assessment team. In addition, the chief audit executive (CAE) must discuss the form and frequency of external assessments and the qualifications and independence of the external assessor or assessment team with the board of directors. Standards (unlike practice advisories, practice guides and position papers) are principal focused mandatory requirements consisting of statements for the professional practice of internal auditing and for evaluating the effectiveness of performance which are applicable at the organizational and individual levels.