Insights

The mystery surrounding IT General Controls; which are they?

Does your accountant also talk about generic IT controls or IT General Controls (ITGCs) that they want to assess? If you want to know which framework is used or if you ask for a list of the IT controls, an answer is hard to find. It is a secret list that apparently every IT auditor and many accountants know, but what and how is unknown. The International Federation of Accountants (IFAC) reveals the secrets surrounding the ITGCs.

13.5.2025

From chaos to control: How risk management helps reduce compliance costs

Discover how strategic risk management helps organizations reduce compliance costs and improve business results in a complex IT landscape.

3.8.2022

The mystery surrounding IT General Controls; which are they?

Does your accountant also talk about generic IT controls or IT General Controls (ITGCs) that they want to assess? If you want to know which framework is used or if you ask for a list of the IT controls, an answer is hard to find. It is a secret list that apparently every IT auditor and many accountants know, but what and how is unknown. The International Federation of Accountants (IFAC) reveals the secrets surrounding the ITGCs.

15.4.2021

New Third-Party Management framework

Contrisity published a Third Party Management framework published in the Isaca Journal

28.10.2020

The risk of working without annoying colleagues

Now the Covid-19 pandemic is again a reason for companies to ask their employees to work from home as much as possible, it’s good to have a look at the risks that transfer from the office environment to the home environment. Maybe you’re glad that colleagues do not irritate you anymore by constantly telling to lock the laptop when you are away. When you go to grab a coffee it’s not necessary anymore to remove your hardware token from the laptop . Does working from home increase or decrease risks?

30.8.2020

Layered security, synchronizing the physical and logical path

Classification of information and segmented/layered security is best practice within logical and physical access procedures. Also, it is mandatory when you need to be compliant to ISO 27001 and it helps to comply with privacy regulations. Information classification and layered security are mostly well implemented, its implemented without a common policy. These two forms of access management, physical and logical, should be complimentary. Let us have a closer look at both implementations and how to implement it as one.

17.7.2020

5 Reasons to conduct an audit on your organization

Asking an audit company to conduct an audit on your organization, whether it’s regarding a SOC 2, ISO, PCI or something else, always needs an investment. The benefits are not always clear. Your company is professional, maybe you have an established company that is known for years within the sector. What are the reasons to become certified or for getting a formal report from an auditor that your organization is fully in control? Let’s find out!

29.6.2020

Findings of the external IT auditor, how to deal with it?

Most companies struggle with the findings external auditor like accountancy firms draw in their management letters. The accountancy firm always seems to be looking for new (IT) findings, whilst the process you conduct within the company is fine. Why should the IT department spend time in solving those management letter findings instead of proceeding with business-as-usual? Let’s share some thoughts.

26.5.2020

6 pros for auditing your supplier

There are many benefits for conducting an audit on your supplier. In an earlier blog I wrote about why you should conduct a right to audit. In this blog we will discuss 6 pros for conducting an audit on your supplier.

23.4.2020

An interim to support your internal audit, the advantage!

Organizations are facing a challenge in staffing; finding the right people and get them employed for your organization is hard. That is one of the reasons for contracting interim professionals to support the internal organization. Contracting interim professionals is not only born out of necessity, there are advantages! Let’s have a look at them.

19.3.2020

Privacy, why it is not only a burden

Did you notice the decrease in people that received your marketing mailings and needed to spend money on consultants and overhead time for complying with GDPR? Getting fined for not being compliant? It’s a pain in the ass and costs money. Will it also bring any good to the organizations? Maybe it is possible it also brings some good.

20.2.2020

The importance of incident and problem management

Incident and problem management, how does it fit your risk management process? Does a risk manager need to be involved in every incident and problem? Let’s have a look at the relationship between incident management, problem management, and risk management.

23.1.2020

Why you should conduct the right to audit

Having a right to audit clause in your contracts with your suppliers, a pretty standard clause to include. Unfortunately, the right to audit is barely used. Nowadays we see large enterprises started to regularly conduct the right to audit on their suppliers (besides receiving a third-party assurance reports). Reason? To be more in control!