This document discusses risk management and auditing processes. It emphasizes the importance of planning over plans alone. Key points addressed include linking risks to corporate objectives, ensuring compliance and other risks are captured, assessing control strengths, and having timely and documented response and remediation processes. Continuous improvement is emphasized through regular risk assessment updates, control self-assessments, analyzing incidents, and using findings to support future prevention.

1. Case Study

2. I have always found that plans are
useless, but planning is indispensable.
- 34th President of the United States, Dwight D. Eisenhower

3. Risk
&
Regulation
Audit Improve
Policy
&
Control
Response
Incident
Report
Investigate Analyze ImproveMonitor

5. Each group should consider the inputs and outputs that
can help to minimize the impact and/or frequency of
risk events

7. Are the
company’s
risks linked to
the key
objectives?
Are
compliance,
regulatory,
reputational,
etc. risks
captured?
For the key
risks identified,
do you feel like
the controls
are strong
enough?
If and when
things occur, can
they be
addressed timely
and properly
recorded?
Do remediation
efforts align
with budget
and strategy?

10. ▪ Risks linked to corporate objectives
▪ Risk register includes compliance, IT/InfoSec,
physical security, etc.
▪ Audit plan based on key areas of risk
▪ Link transactional data to risks to provid full
picture

11. ▪ Map audit findings back to key enterprise risks
to enable full transparency and prioritization
▪ Setup key risk indicators that align with
enterprise risks (can this be automated?)
▪ Revisit audit plan every 6 months
▪ Push out control self-assessments

12. ▪ Use risk assessment to determine appropriate
responsive action
▪ Setup, implement and track SOPs and SLAs
(saves, near misses, etc.)
▪ Formalize electronic incident capture,
investigation and case management
▪ Root cause analysis
▪ Site audits

13. ▪ Is there a link back to overall strategy?
▪ Is this information available to audit and risk?
▪ Do actions result in risk going down, control
strength increasing, etc.?
▪ How does this information help to support
possible future prevention or limit impact?

14. kevin@resolver.com