Discussion The Influence of IA on Information Security

Discussion: The Influence of IA on Information Security Effectiveness: Perceptions of Internal Auditors Urton Anderson, CCEP Director of the Von Allmen School of Accountancy and Professor The University of Kentucky

Agenda Contribution – Putting the Paper in a Larger Context § IA and its relationship to other assurance providers § 3 Lines of Defense Model § Reliance on assurance providers Some specific issues for discussion § Should incidents go down? § What is a finding? § What is the “quality of relationship”?

IA and its relationship to other assurance providers Who provides assurance in organizations?

Organization as a Web of Assurance

Assurance Network

3 Lines of Defense

Reliance on assurance providers

COMBINED ASSURANCE King III Principle 3. 5 The audit committee should ensure that a combined assurance model is applied to provide a coordinated approach to all assurance activities. 8 2/22/2012

Risk Assurance Map – Starting Template Assurance Regulatory Oversight 4 th Line Remove Duplicate Assurance Activity Review Other Assurance Providers Obtain Independent Assurance Provision Corrective Action Regulators Investigations - Proactive Safety Monitoring Quality Audit Compliance Internal Audit External Audit IT Steering Group SOX Network Development Forum Environmental Management Group Safety Review Board Performance Review Meeting Independent 3 rd Line Provider Assessment o. Low Compliance Risk Management Processes Communications Assurance Provider Planning Commercial Legal Procurement IT Operations Treasury Human Resources Functional Oversight 2 nd Line Overall Provision o. Medium o. High Assurance o. Opportunity to Remove / o. Refocus Effort Results Asset Safeguarding Business Continuity Crisis Management Competitive Environment Economic Environment Hedging/Liquidity Management Financial Reporting Finance Processing International Operations Information Technology Labor Relations/Staff Legal Operations Regulator & Stakeholders Revenue & Reputation Environment Suppliers & Key Relationships Finance Performance Provider Management 1 st Line o. Assurance Gap o. Maintain Current Status

Assurance Map (PWC)

Specific Issues What is a finding? Should incidents go down? What is the “quality of relationship”?

Relational Coordination Theory § Jody Hoffer Gittell - Brandeis University

Relational Coordination Theory § “New Directions for Relational Coordination Theory, ” in The Oxford Handbook of Positive Organizational Scholarship, 2011 § The Southwest Airlines Way: Using the Power of Relationships to Achieve High Performance (Mc. Graw-Hill, 2003) § High Performance Healthcare: Using the Power of Relationships to Achieve Quality, Efficiency and Resilience (Mc. Graw-Hill, 2009)

Urton Anderson Von Allmen School of Accountancy The University of Kentucky (859)218 -1788 urton. anderson@uky. edu