Audit Planning/Process

Limitations until initiatives
are implemented

e.g. Vendor Management or BCP

Sample across BUs

Code Migration

Ensuring ownership
of functional areas

Vendor mgmt

understanding per BU

Running ideas of what is
going on within BU

Challenges w/ federal examiners

Potential risk

Understand and document why and whatundefined

Value-add - including all areas

committment to org.

Include product overview
during scoping call

Understand product
before audit fieldwork

Ensure testing addresses risks

no central handle on
contract mgmt or compliance

Central repository

Endevor

RMS

ClearQuest

categorize

avoid missing areas

Accurate interdependency matrix

Impact for locations

More like Remedy audit

More detailed reviews

Mainframe

RXP

Ensuring coverage of
compensating controls w/in ERA

E.g. Password reqs

Self-reporting of ERR compliance

Pick critical areas
to cover on audits

what falls under
finance team scope?

e.g. vendor mgmt

Fin. team to start taking
on more operational
audit areas in 2012

Audit team members to
become members of
project teams outside
audit deptartment

Due diligence

"Need to do"

SOX

Are commitments definite?

FFIEC governed areas

Ways to change committments

e.g. tiers

Justification

Ideas on how to carve out
audits to be more manageable
and more in-depth

Justification to rotate
through audit schedule

What areas are too broad?
What made you uncomfortable?