Compliance Week describes itself as “an information service on corporate governance, risk, and compliance.” A whole industry has sprung up this decade presenting “GRC” as a single business function, with myriad products and services ostensibly to help companies manage it as such. But can you really audit these three broad, distinct subjects in a unified […]
Jose Tabuena
Posted inInternal Controls
Making Sure Your ID Management System Works
Consider the passport security breach of three presidential candidates last year. Did the State Department have appropriate security controls that should have prevented the breach? Why did senior State Department staffers not learn of the improper access until more than two months after they first occurred? The importance of data and information security has become […]
Posted inInternal Controls
Advice for Conflict-of-Interest Audits
Perhaps no other area of business conduct is as fraught with potential peril as are conflicts of interest. In my October 2008 column, I wrote on how abuse of travel and entertainment expenses can hint at bigger fraud problems. We’re in luck; similar irregular spending habits can also be red flags for potential conflicts of […]
Posted inAccounting & Auditing
Auditing T&E Programs: Where to Find the Fraud
In his August 2008 column, Dan Swanson wrote about returning to internal auditing roots by looking at specific departments (finance, human resources, and so forth) rather than auditing’s flavor of the month—such as enterprise risk management, information security, and fraud control. Here I suggest internal audit units go further by returning to even more prosaic […]