5 Project Management Tips for Information Security Audits
by Sarah Harvey / August 13th, 2019
When most people think of auditing, they automatically associate it with negative emotions such as stress or anxiety. At KirkpatrickPrice, we understand that undergoing an information security audit can be an overwhelming task for organizations, and we want to partner with you to ensure that we can alleviate as much of that stress as possible. However, while we have processes, personnel, and tools like our Online Audit Manager to help your organization succeed, an audit engagement is a two-way street, and your organization must be sure to manage the project efficiently. To do so, we’ve come up with a five tips for project management for information security audits.
Project Management Tips for Information Security Audits
1. Know What You’re Getting into Before the Audit Begins
Often times, organizations fail to thoroughly research and understand what exactly will be expected of them during an audit engagement. For many organizations, this is because it is their first time undergoing an information security audit. Before an audit engagement begins, organizations need to familiarize themselves with their audit firm’s audit processes and the framework(s) that they are going to be audited against. This might mean reviewing the actual framework itself, like the PCI DSS or HITRUST CSF, or referencing educational materials to prepare your organization, like KirkpatrickPrice’s SOC 2 Academy.
In addition to familiarizing your organization with the frameworks and audit processes, organizations must ensure that everyone in their organization is on board with the information security audit from the start and that they are willing to participate as needed. Gaining the buy-in from C-level executives all the way down to department heads or key team players will make the audit engagement more efficient because everyone knows and understands what’s at stake during the audit and how they can play a roll in ensuring the completion of the engagement.
2. Make an Information Security Audit Strategy
For every organization, the audit process is different depending on the time, personnel, and financial resources available. The audit process is also different based on what services you choose. Will you go through a gap analysis? Are you provided with a remediation plan? How long will it take you to remediate? Do you have multiple audits happening simultaneously? This is why establishing an audit strategy is essential to project management for information security audits. Organizations must determine who will oversee the engagement, how the progress of the engagement will be tracked, and other considerations that could impact the completion of the audit, such as what would happen if someone from the company (i.e. a Director of IT) left the company during the audit.
3. Select a Leader to Oversee the Information Security Audit Project
Want to ensure a successful audit? Selected a leader to oversee the engagement. At KirkpatrickPrice, we call this person the executive sponsor. This is typically a C-level executive who will manage the project, serve at the point of contact between your organization and ours during the engagement, and ensure that the project remains on schedule. If a problem arises during the audit, this person should be able to effectively communicate those problems to other stakeholders in the audit and work with the audit partner to find solutions and get the engagement back on schedule. This component is especially important when it comes to project management for information security audits.
4. Stay on Top of Deadlines
By far and large, sticking to deadlines during an audit period seems to be one of the most pressing concerns for organizations. When prospects approach us about engaging in an information security audit, we’re often asked if we be able to complete the audit and report by a specific date or told about a hard deadline that compresses the timeline. Because most organizations do need an audit by a specific date, we have streamlined our audit process to ensure an efficient delivery system. However, this system only works the way it’s designed to if our clients are held accountable and complete the work they’re assigned on time. Why? Because even the smallest delay, such as not turning in artifacts or evidence when requested, can lead to receiving your report later than it’s needed, and it could also cost you in late fees, clients, or even legal penalties. Additionally, to ensure efficient project management of information security audits, organizations must analyze the availability of the key players in the engagement. For example, what holidays will impact your deadline? Are there any team member vacations scheduled during the engagement? If so, how will the workload be distributed or completed to ensure that no delays occur?
5. Utilize Your Audit Partner
Project management for information security audits may seem like a daunting task. If you feel unsure about your progress during the audit engagement, utilizing your audit partner is a great way to get back on track. At KirkpatrickPrice, our Client Success Team and experienced Audit Support Professionals are available to answer questions, provide time management help, and additional resources to ensure the successful completion of an audit engagement all year round. Unlike many other CPA firms who drop or neglect clients during the busy tax season, we won’t because we’re solely an information security auditing firm. Our clients can rest assured that if they have questions about their audit – no matter what time of year – we’ll be there to help.
Here’s the thing: whether done because it’s required or because your organization wants to be proactive, information security audits are an investment that should not be taken lightly. At KirkpatrickPrice, we’re committed to helping our clients get the most out of their investment, but our clients must understand the critical role project management plays into information security audits. Project management helps ensure the efficiency of the engagement, ensure that deadlines are met, and ensure that reports are delivered on time. Ready to get started on your audit? Want to learn more about project management for information security audits? Contact us today.
More Auditing Resources
When Will You See the Benefit of an Audit?
Leveraging Information Security as a Competitive Advantage
Getting Executives on Board with Information Security Audits
