IT Audit & Compliance Blog

With all the commerce and other types of transactions and information that traverse the Internet, it is useful that there are organizations such as the CSA, AICPA, and many others, which are focused on serving the public’s interests. And while nothing will ever give complete assurance as to the internal controls for a service organization, [...]

To the untrained eye, terminations may seem like a straightforward process; in reality, managing this process is more like herding cats. The offboarding process varies from company to company, involves multiple departments, relies on strong lines of communication, and requires accountability from the parties involved. At a high level, the termination process consists of the [...]

Artificial intelligence (AI) is no longer a term; it plays a crucial role in driving innovation across many industries. However, effectively utilizing AI requires managing the risks associated with it. This is where ISO/IEC 42001:2023 steps in—a standard crafted to aid organizations in handling AI-related risks and guaranteeing the security, ethics, and reliability of their [...]

Many organizations do a tabletop test each year of their Incident Response (IR) or Business Continuity/Disaster Recovery (BC/DR) plan to evaluate its effectiveness and make sure it’s current. While tabletop is generally the weakest form of testing and has some significant limitations, there are some things that can be done to make it a better [...]

Sarbanes-Oxley (SOX) is an act originally signed into law in 2002. The act is named after Senator Paul Sarbanes and Representative Michael Oxley, who were the main architects of the act. [...]

The National Institute of Standards and Technology (NIST) defined their Risk Management Framework (RMF) in Special Publication (SP) 800-37. [...]

The recent CrowdStrike outage, which caused widespread system crashes and disruptions, served as an important reminder of the interconnectedness and fragility of our world as it relates to technology. While the incident was disruptive and many of our clients can attest to the headaches it caused, it also provided valuable insight into how organizations can [...]

In today’s day and age, most organizations rely on vendors for portions of the services they provide or to assist with the security and integrity of their technology and data. Managing the relationships with these vendors is important, in addition to monitoring the ongoing performance of the services provided by these vendors. When pursuing a [...]

Recently, a client asked if we could provide them some insight on the similarities, differences, advantages, and disadvantages of getting a SOC 2 Security versus an ISO/IEC 27001:2022 certification. [...]

With no shortage of regulations around data security and privacy, it’s no wonder that determining which regulations must be complied with and whether your company has compliance gaps can be a daunting task. Regulatory compliance is mandatory, but can be overwhelming. Where should you start? Perform a Risk Assessment Risk assessments are valuable tools for [...]