SF ISACA Fall Conference audit holistic approach

Compliance in Multiple RegulatorySettingsa Holistic ApproachVanessa BaloghSan Francisco ChapterKey Problems• Compliance with multiple regulations– FDA, SOX, HIPAA,GLBA,BASEL II, PCI, more• Lack of transparency, ownership andaccountability for risk management• Multiple compliance efforts in multiple businessareas– Policies, standards, procedures and documentation• Reactive approach to technical and regulatoryconsequences of enterprise change2007 Fall Conference2San Francisco ChapterComplex Regulatory SettingsIndustry RegulationsPharmaceutical FDA, SOX*, HIPAA,SB1386E-Commerce PCI, SB1386, SOXPublic Utility SOX, HIPAA, SB13862007 Fall Conference3San Francisco ChapterInefficiencies and Duplicate Effort• No integrated risk assessment of businessprocesses• Every “function for itself” to get intocomplianceCFO COO CIOInternal Audit Business ITFDAAnti FraudSOX PrivacyPrivacy PCIPCI2007 Fall Conference4San Francisco ChapterSOX the ‘aftermath”• Rules & Regulations forced to “quick anddirty” compliance solutions• Inconsistent standards, processes anddocumentation• Compliance effort still on shaky grounds2007 Fall Conference5San Francisco ChapterWhat companies face today?• Deficiencies go unaddressed• Strategic consequences arise ifcompanies are unable to effectively,timely and efficiently adapt2007 Fall Conference6San Francisco ChapterEven the Regulator’s think it’s…..• “…A common trend for both large and small ...