IT Risk Awareness Brian Clark Partner Deloitte Touche

IT Risk Awareness Brian Clark Partner Deloitte & Touche LLP Chad Murphy Director Deloitte & Touche LLP

Agenda Top Information Technology Risks Areas IT Risk Area within Key IT Processes Internal Audit’s role bridging the Board Level Knowledge Gap 2 Copyright © 2016 Deloitte Development LLC. All rights reserved.

Top IT Topics – 2016 Edition Cyber Assurance Drone Technologies Third-party Management Alternative Workforce Virtual Reality Sensor Proliferation Payment Systems Data Management/Data Governance Artificial Intelligence Disaster Recovery and Resilience 3 Copyright © 2016 Deloitte Development LLC. All rights reserved.

Cyber Assurance Cyber Risk in an Io. T World Internet of Things offers new ways for businesses to create value; however, the continuous connectivity and data-sharing also creates new opportunities for information to be compromised. Io. T initiatives demand targeted strategies to combat the influx of new cyber risks that will invariably accompany them. Issues • Cybersecurity risks are being managed by enterprise programs. • They require an assurance component currently lacking in many organizations. • Evolving standards and regulations (e. g. , Federal Financial Institutions Examination Council (FFIEC), Securities & Exchange Commission (SEC)) will make this a critical component of internal audits going forward. Risks • Direct loss of money • Impact to organizational brand • Loss of critical or confidential data • Fines and/or sanctions 4 Copyright © 2016 Deloitte Development LLC. All rights reserved.

Sensor Proliferation “Smart” Technologies These technologies are crossing industries and have 3 main categories, the Nodes (end points), Gateway (connection) and Cloud (internet). As the use of sensors continues to grow along with the application and uses of sensors the ability to manage the data and risks associated with the data become increasingly important. Historically, companies would utilize data to identify trends and build advertising programs. In the near future, the availability and speed of the data will provide companies the ability to make strategic decisions to gain market advantages. Issues • Rapid expansion of distributed sensor nodes, which in turn help drive and/or control business events. • May or may not be connected to the Internet of Things (Io. T). Risks • Effective management of very large numbers of sensors • Effective data usage processes and policies • Variety of risks related to inoperable sensors • Potential increased cyber exposure 5 Copyright © 2016 Deloitte Development LLC. All rights reserved.

Data Management/Data Governance Data Security Managing data has become an increasingly complex task for many organizations. With the proliferation of technology, an exponential growth in data has occurred. Unfortunately for companies, data has value and therefore must be available, usable, maintain integrity and most importantly protected. Organizations must identify, categorize and defend their data, while at the same time providing access to the data to be used. Issues • Increased scrutiny of data life cycle management by regulators, auditors, customers, employees, and business partners • Issue is exacerbated due to device proliferation, cloud support, emerging malware technologies, evolving regulatory requirements, and file-sharing solutions Risks • Fines, financial impacts • Loss of brand value • Loss of critical data 6 Copyright © 2016 Deloitte Development LLC. All rights reserved.

Third-Party Management Ecosystem risk As manufacturers extend Io. T-enabled processes and systems beyond their own organizations to encompass additional parties, information flows across multiple external devices and databases, each under the control of third-party organizations. These third parties—vendors along the supply chain, network operators, cloud services providers, device manufacturers, and end-use customers, among others—may not recognize that their secure, vigilant, and resilient strategies (or lack thereof) have implications for the systems of every other stakeholder: The chain is only as strong as its weakest link. In other words, enterprises should consider behaving as if the responsibility for security were theirs, and theirs alone. Issues • Increased reliance on third parties or outsourced service providers (OSP) for technology and/or support solutions • Ease of procurement for third-party solutions, particularly point-specific cloud solutions • COSO 2013 requirement for management of OSPs Risks • Lack of understanding of what data and solutions are currently provided by OSPs. • SOC 1 reports may not provide enough coverage. • Loss of critical business data. • Lack of effective controls. 7 Copyright © 2016 Deloitte Development LLC. All rights reserved.

Payment Systems Mobile Payments Along with all of the technology shifts over the last decade, the payment systems have dramatically changed. With the introduction of mobile payment and electronic currencies, a growing list of risks has evolved. While the financial institutions have focused on these risks, the data that is being created from these transactions has continued to provide risk and opportunities across many industries. Additionally, the regulators continue to try and stay at the forefront which provides additional requirements for organizations. Finally, the availability of the data provides additionally risks in organizations. Issues • Rapid technology shifts in non-cash alternative payment solutions, from contactless and mobile transactions to alternative currency options • Forces regulatory and process changes, as well as customerfacing issues Risks • Exposure to cyber attack • Regulatory requirements • Inability to manage cash effectively • Privacy laws 8 Copyright © 2016 Deloitte Development LLC. All rights reserved.

The Elements of IT Risk IT Governance • Mission Business Strategy Corporate Governance Regulatory & Legal Technology Trends • IT and Business Alignment • Portfolio Management • IT Risk Management • Policy IT Strategy & Planning • IT Planning • Strategic Sourcing • IT Organization • Human Resources • Asset Management • Budgets, Metrics & Controls IT Processes Architecture Project Management • Technology Planning • Emerging Technologies • Standards • Architecture Design & Applications & Databases • Project Management Lifecycle (PMLC) – Initiating – Planning – Executing – Controlling – Closing • Systems Development (SDLC) – Design – Acquire / Build – Test & QA – Data Conversion – Implement / Deploy – Support / Maintain • Project Risk (Pre-Imp) Review • Post Implementation Review Management –Software –Infrastructure –Security • Vendor / Product Selection • Integration & Consolidation • Security Configuration Management –Applications –Operating Systems –Databases –Networks –Hardware & Tools • Identity and Access Management –User Provisioning –Administrative Access –Segregation of Duties –Remote Access –Third Party Access Operations • Change Management • Data Processing –Batch Scheduling –Online Processing • Application / Database Management –Capacity –Availability –Performance • Facilities Management • Data Retention / Backup –Scheduling –Processing –Offsite Storage –Retrieval & Restoration (Applications, Databases & Infrastructure) –Change Prioritization –Documentation, Approval, and Tracking –Acquire / Build –Test & QA –User Acceptance –Approval to Transfer to Production –Emergency Changes • Patch Management • Configurable Controls • Data Quality & Integrity • Interface Validation & Integrity Enterprise Security Support • Threat & Vulnerability Management –Intrusion Detection / Response –Intrusion Prevention –Security Penetration & Vulnerability Testing –Virus Prevention / Detection • Problem Management –Help Desk –Incident Response –Root Cause Analysis • Service Level Management • Vendor / Third-Party Management • End-User Computing • Software Licensing • Security Strategy & Compliance • Security Awareness & Training • Physical Security • Privacy & Data Protection Disaster Recovery • Business Impact Assessment • Disaster Recovery Planning • Communications / Crisis Management Plans • Disaster Recovery Testing • Ongoing Maintenance / Updates Infrastructure • Operating Systems 9 • Database Structures • Networks (Internal & Perimeter) • Hardware • Locations • Tools (E-mail, EDI, Messaging, etc. ) Copyright © 2016 Deloitte Development LLC. All rights reserved.

IT Risk Areas Deserving Increased Focus IT Governance: • Mission: The mission of IT is not aligned to protect the value of its existing assets and create new or future value. • IT and Business Alignment: Corporations increasingly do not coordinate IT with business processes to realize their true value. • Portfolio Management: The IT Portfolio is not reliable or adequately available. • IT Risk Management: IT compliance with laws and regulations. Enterprise Security: • Security Configuration Management: Security administration processes are undefined. • Identity and Access Management: System Configurations are not in line with the security policy. Access to systems is not managed to ensure access is appropriately administered timely. Firewalls are not properly configured or monitored to prevent/detect unauthorized access and malicious attacks. • Security Penetration & Vulnerability Testing: Tools and techniques are not in place or not properly configured to periodically test and report to management. • Security Awareness & Training: Security notifications and training do not exist to make users aware of their responsibilities in securing corporate data. • Security Compliance: Management has not implemented a security compliance program to address regulatory requirements (HIPPA, GLBA, SOX, etc. ) 10 Copyright © 2016 Deloitte Development LLC. All rights reserved.

IT Risk Areas Deserving Increased Focus - Continued Crisis Management: • Business Impact Assessment: An enterprise-wide disaster recovery plan has not been prepared or is not based on a business impact assessment. • Communications / Crisis Management Plans: Management has not prepared or coordinated with cross-functional business units to ensure appropriate escalation and communication of crisis management (declaration and ongoing communication). • Service Level Agreements: Relationships with third party vendors do not exist to ensure IT operations continuity in case of disaster/crisis. • Insurance: Insurance agreements do not exist for the IT infrastructure or Business Impact • Site Reconstruction / Relocation: The disaster recovery plan does not contain a strategy to either rebuild or relocate IT operations permanently to ensure continuity in the case of total loss of production systems. • Disaster Recovery Testing: Management has not periodically tested the disaster recovery plan or has not documented results and incorporated improvements into the disaster recovery plans. 11 Copyright © 2016 Deloitte Development LLC. All rights reserved.

Word to your…Board “The oldest and strongest emotion of mankind is fear, and the oldest and strongest kind of fear is fear of the unknown” ― H. P. Lovecraft, § IT topics are at the top of the Board agenda for many reasons – FEAR being one of them § IA has the opportunity to build bridges for the board by sharing knowledge, being patient, dispelling myths and purveying facts § Effective IT risk assessment is a necessary step to build knowledge, dispel fear and take appropriate action 12 Copyright © 2016 Deloitte Development LLC. All rights reserved.

Summary The initial assessment should be a broad evaluation, focused on “probable” threats. • Be a student of your business – stay curious, explore new topics ask questions • Determine which items may be relevant in your business and technical environment. • Ensure that risk assessment and audit universe address relevant items. • Collaboration and communication with IT, audit committee, and other stakeholders are key. • Plan resource requirements • Communicate frequently and patiently with Board/Audit Committee. 13 Copyright © 2016 Deloitte Development LLC. All rights reserved.

Contact Information Brian Clark Partner, Deloitte & Touche LLP 913 -908 -9541 bclark@deloitte. com Chad Murphy Director, Deloitte & Touche LLP 817 -602 -5558 chadmurphy@deloitte. com 14 Copyright © 2016 Deloitte Development LLC. All rights reserved.

This presentation contains general information only and Deloitte is not, by means of this presentation, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this presentation. About Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. Please see www. deloitte. com/about for a detailed description of DTTL and its member firms. Please see www. deloitte. com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting. Copyright © 2016 Deloitte Development LLC. All rights reserved. Member of Deloitte Touche Tohmatsu Limited