SOC 2 Academy: Integration with the COSO Framework

by Joseph Kirkpatrick / December 16, 2022

The Five Components of Internal Control: CRIME The COSO Internal Control — Integrated Framework is one of the most common models used to design, implement, maintain, and evaluate internal controls and is split into five components: control environment, risk assessment, information and communication, monitoring activities, and existing control activities. A common way to remember these five components that are used to evaluate the effectiveness of internal controls is the acronym…

California Consumer Privacy Act vs. GDPR: What Your Business Needs to Know

by Sarah Harvey / December 22, 2022

Data Privacy and Security in the US According to Pew Research Center, 64% of American adults have experienced data theft. Yahoo, eBay, Equifax, Target, Anthem, Home Depot – it has become habitual to worry about data breaches, identity theft, and other privacy concerns. With every new headline of a data breach, it seems like consumers are losing more control over what personal information is publicly available. At the same time,…

GDPR Readiness: Challenges for Organizations Outside of the EU

by Sarah Harvey / February 20, 2023

Although the EU’s General Data Protection Regulation (GDPR) enforcement deadline has passed, many non-EU organizations are still questioning what they need to do to ensure compliance. Do they need a designated representative? Where does their designated representative need to be located? Is a designated representative the same thing as a Data Protection Officer? Who do they need to notify that they have a designated representative? How do they do this?…

Why is Vendor Compliance Management Important for Your Business?

by Sarah Harvey / February 6, 2023

Vendor compliance management is the process by which organizations understand and control the risks associated with working with vendors, third parties, or business partners. If your organization utilizes vendors to conduct part of your business process – whether that be billing, customer service, data processing, etc. – the risks associated with that partnership could ultimately put you out of business. An effective risk management strategy includes a strategic process for…

SOC 2 Academy: Points of Focus

by Joseph Kirkpatrick / December 16, 2022

What is a Point of Focus? In the past, many organizations have struggled on their journey toward SOC 2 compliance because they lacked an understanding of what they needed to do to comply with the Trust Services Criteria. As such, one of the enhancements to SOC 2 reporting includes points of focus, which will assist organizations when they are designing, implementing, operating, and evaluating controls over security, availability, confidentiality, processing…