Regulatory Reality:

risk


July 17, 2011  10:01 PM

Vendor management: What’s missing in this big picture?



Posted by: David Schneier
assessment, Audit, compliance, exam, examinations, GLBA, regulatory, Regulatory Compliance, risk

I do a whole lot of work with vendor management, a fact which most of my regular readers are quite aware of.  And while I typically recoil when somebody else says of themselves what I'm about to say, I'm going to say it anyway; I'm really something of an expert on the discipline, particularly as...

May 20, 2011  3:29 AM

Does the banking industry understand what risk-based means?



Posted by: David Schneier
compliance, FFIEC, GLBA, regulation, regulations, regulatory, Regulatory Compliance, risk, risk assessment, risk-based

Years ago I added an addition to my first house. After my second child arrived, we had simply run out of room and decided it was easier to expand our current living space rather than trying to find a bigger one. Plans were drawn up, work scheduled and money deposited. Two days before the first...


April 26, 2011  6:00 AM

Is compliance moving too fast?



Posted by: David Schneier
assessment, Audit, compliance, exam, examiner, exams, GLBA, governance, GRC, NCUA, oversight, regulations, regulatory, Regulatory Compliance, risk

I joined a new group last week on LinkedIn focusing on compliance within the banking space and during my first visit answered a forum question that started with "How do you manage the flow of compliance information"?  It was a relevant question and I was happy enough to offer my two cents (never a...


April 18, 2011  6:22 PM

Epsilon: Why vendor management is critical.



Posted by: David Schneier
Audit, bank, banking, compliance, FDIC, FFIEC, GLBA, NCUA, regulatory, Regulatory Compliance, requirements, risk, SAS 70, vendor, Vendor Management

A few years back we hired a local painting contractor to do some work around my house.  Upon completing his sales spiel he announced that he often relies upon subcontractors for the less skilled work and wanted to be upfront about that before we entered into any sort of deal with him.  Anyone he...


April 8, 2011  10:45 AM

GRC is about to see its future.



Posted by: David Schneier
Audit, compliance, GLBA, governance, GRC, HIPAA, PCI, regulations, regulatory, Regulatory Compliance, risk, SOX, UCF

After nearly a quarter century of working in and around the corporate IT domain I have a grand total of four bold predictions I've made that stand out.  Three of them I had nailed dead on and the fourth never panned out a fact that confounds me still to this day. The...


March 8, 2011  4:58 PM

Does GRC scale to size?



Posted by: David Schneier
assessment, Audit, bank, banking, compliance, credit union, CU, exam, examination, examiner, exams, governance, GRC, regulation, regulatory, Regulatory Compliance, risk, risk assessment

We were having an internal conversation this past week about governance, risk, and compliance (GRC) and I was asked about its role in the small and...

Bookmark and Share     0 Comments     RSS Feed     Email a friend


February 27, 2011  7:31 PM

Does an IT auditor need to be CISA certified?



Posted by: David Schneier
assessment, Audit, audit plan, audit program, CISA, CISSP, regulations, Regulatory Compliance, risk, risk management

It's been a while since my last post as I'm in hunker-down mode as we prepare our next compliance software offering for release.  But in the midst of my coding/testing insanity, a conversation occurred that brought up the value of certifications that I haven't been able to completely let go...


January 8, 2011  5:41 PM

New year advice on developing a business continuity plan



Posted by: David Schneier
Audit, bcp, BIA, business continuity plan, business impact analysis, exam, examiners, FFIEC, GLBA, regulatory, Regulatory Compliance, risk, risk assessment

One of the first things I had to work on this week (and thus one of the first things to work on in the new year) was finalizing a report from last year. The report covered the results of a Business Continuity Plan desktop test and the client needed some clarifications around the results. I've...


November 16, 2010  6:07 PM

What is the practical value of compliance policies?



Posted by: David Schneier
Audit, bcp, compliance, general controls, GLBA, NCUA, regulatory, Regulatory Compliance, risk, risk assessment, Security

My practice recently wrapped up an engagement in which we conducted a tabletop test of a client's business continuity plan.  As always with such exercises, it's interesting to find out how much distance exists between what's documented in an institution's policy/program and how business is...


October 11, 2010  3:56 PM

Vendor management program efforts still fall (way) short



Posted by: David Schneier
assess, examination, examiner, GLBA, NCUA, periodic review, regulations, regulatory, Regulatory Compliance, risk, risk rating, third party management, third party oversight, vendor, Vendor Management, vendor risk rating

Early last week I downloaded some fresh content covering vendor management.  It turned out that the new information wasn't really new, it's guidance that's been circulating in one form or another for years and tracks closely with guidance ripped from the pages of the Sante Fe Group/BITS Shared...


Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: