Prudent Security Admin: Has a New Data Breach Precedent Been Created?
Prudent Security Admin: Has a New Data Breach Precedent Been Created?
— Read on securityboulevard.com/2019/01/prudent-security-admin-has-a-new-data-breach-precedent-been-created/
Disaster relief: How can AI improve humanitarian assistance?
The unique topic of artificial intelligence (AI) for humanitarian assistance and disaster relief (HA/DR) was in the spotlight last week, as leading minds from academia, industry and the federal government met to discuss how modern technology can help victims of disasters around the globe.
Source: Disaster relief: How can AI improve humanitarian assistance?
How google is slowing innovation – a lesson for auditors
Read this very interesting article: “How Google is slowing innovation” by Aytekin Tank https://link.medium.com/e4EYifNJNR
One lesson is that auditors should not shy from pressing management on strategic risks.
I recently wrote an article about blockchain and its implications for the audit profession. Interestingly Google and other social media giants should be thought of as also being in the cross hair of the blockchain technology. Google’s quest to execute the Microsoft’s strategy: embrace, expand, extinguish has led them to try to stop innovation or to be an innovation bottleneck. Here is how I summarize Google’s rather potent strategy:
- Embrace the internet (give things for free e.g. email accounts, search)
- Expand (develop and market our data using surveillance methodologies and analytics – the worrisome part)
- Extinguish (the internet’s traffic is now going through google, including by the way our brains as we “google everything”)
But again, for fellow auditors, perhaps there is also an important lesson to draw. Strategy and its execution remain the most important factors to examine. Many of us focus on financial risks and in fact others constraint us to think and work mostly on financial risks and in the “numbers realm”.
Its the strategic risks and its management (e.g. Social distrust of Google’s slick intermediation role) that we should train our attention to. More precisely, we should challenge management to have more robust risk identification and mitigation efforts. We are uniquely qualified to do so because of our mandate to be independent and objective. The risks with google and its good old “bait and switch” approach remains the enormous potential backlash (privacy concerns, power concentration, mistrust).
Bait and switch is not another phrase for innovation
Do you think auditors are focusing enough on strategic risks? Do auditors have the capacity to do so in a credible way? Do auditors have the mandate? How can auditors become better at it – what will it take? Your thoughts?
Blockchain: the auditing profession’s death nail?
Some people have said blockchain, at this stage, is like the internet in the early 1990′s. I argue it can never be too early to think about it or to jump on and particularly for auditors since it being called the “trust machine”.
For people, we have laws and regulations, including the legal systems, law enforcement authorities and lawyers. For assets or property, we have accounting principles, including financial recording/reporting systems, banks and exchanges, accountants and auditors. All of these, I have mentioned, form part of the elaborate mix of people, resources, systems and tools that support and scale economic/financial trust i.e. they make business possible at scale.
Auditors provide assurance (trust) w.r.t assertions that companies make in financial statements and about their internal controls. The assertions are well known, existence, completeness, rights and obligations, accuracy and valuation, and presentation and disclosure. A fundamental challenge that has come to the fore, with the growth of cyberspace, global interconnectedness and data proliferation, has been the continued effectiveness of the above mentioned trust system. Privacy concerns, unsanctioned use of data, fraud, rising intermediation costs (fees from financial institutions and others) have driven a search for alternative approaches to achieve reliable and safe financial and business transactions. Other factors such as reduced confidence in central institutions (banks, big social media companies, governments etc.) have equally contributed to the search for alternatives.
This is where blockchains have come in. And to clarify any confusion bitcoin is just a digital currency and it is based on the use of blockchain technology. It is the latter that is interesting. Many other blockchain uses exist, that where the excitement come it.
Blockchain or to use the more general terminology, Distributed Ledger Technology (DLT), provides a new and formidable trust model for economic activity. Distributed ledgers maintain transactions or contracts in a decentralized manner, usually across different locations, people and computing systems. The use encryption and a concept called proof of work, so that transactions cannot be easily altered – a robust and immutable audit trail. The transactions can be of any type, for example of cash or of asset inventory. It eliminates the need of a central (trusted) authority to keep a check against manipulation. The benefits include reduced processing time, reduced transaction costs, transparency, security, low fraud and trust. Notice that in our current system we assume that the trusted party will not manipulate anything – we have been disproven, many times over on that assumption.
Like any new and major technology, it will affect jobs, career opportunities, job tasks and the value-add that current audit professionals provide. This will likely be in some unpredictable ways, hence some fear. Some have predicted that distributed ledger technologies may eliminate 97% of the job auditors do. Others see it transforming audit work and creating new opportunities (see Journal of Accountancy article). Either way, it is clear that auditors should become familiar with distributed ledgers.
As an nonprofit auditor, I am particularly interested in what this will mean for the way we do business in the international arena and with less economically developed countries.
Has your CFO considered blockchain? Has your audit team considered what it will mean for its audit program and the skillsets to provide audits and deliver or value add? Please comment. The video link below provides a great overview.
Internal audit contributes to the mission too – be positive
“Why, then, ’tis none to you, for there is nothing either good or bad, but thinking makes it so. To me it is a prison. Well, then it isn’t one to you, since nothing is really good or bad in itself—it’s all what a person thinks about it. And to me, Denmark is a prison.” – William Shakespeare
Throughout my career, I found that I did my best internal audit work when I had optimistic thoughts about the mission and about teaming up with management as a partner to make improvements. It is so important for internal auditors to bring optimism to the job. To think of possibilities and be balanced about the risks they observe.
No doubt, we must remain objective in our assessments and exercise professional skepticism in our confirmations. Nevertheless, I strongly believe that advancing the mission, being mission driven, in part means positive thoughts about the organization and the people. Taking a minute to see the good things and to appreciate management’s strengths can be just as important as the exceptions we point out in our audit report.
Such an attitude to audit work, to the audit team, has the added benefit of helping break communication barriers with auditees and encouraging the free flow of information.
Share your thoughts on positive thinking in audit engagement. Has it been helpful to you? How do you stay positive when everyone expects the “mean” auditor? How do you balance due professional skepticism with positive thoughts? Is audit organizational culture relevant to adding value?
Privacy and Security of Data at Universities — Security Boulevard
Interesting paper: “Open Data, Grey Data, and Stewardship: Universities at the Privacy Frontier,” by Christine Borgman: Abstract: As universities recognize the inherent value in the data they collect and hold, they encounter unforeseen challenges in stewarding those data in ways that balance accountability, transparency, and protection of privacy, academic freedom, and intellectual property. Two parallel…
via Privacy and Security of Data at Universities — Security Boulevard
Good risks, what is your nonprofit doing about them?
Nonprofits should be considering “good risks”. Managing these risks can save a lot of money and mean a lot more for achieving their mission goals. Similarly, nonprofit auditors, as risk subject matter experts are well positioned to lead the charge and begin to change the under appreciation of good (positive) risk management.
When most auditors, or even managers think of risk management, their focus is mostly trained on negative risks and their mitigation. Often this is the mandate that their board audit committees focus on and the direction auditors are steered to. However it is important to begin to realize that nonprofits can ill-afford this. In my view, this is particularly costly for nonprofits in the humanitarian relief sector where in addition to costs, under appreciation of positive risks limits the capacity to bring more relief to populations in need and to make important investment decisions.
Ironically, many people’s eyes glaze over when positive risk management is mentioned. They think positive risk is some “rich” problem to have. They think of positive risks as competing for attention/airtime with the more scary negative risks. Others just disregard the idea as an academic novelty. But if you consider that business objective/outcome variability is a function of both positive and negative risks effects, then it is easy to see that this gives more options for mitigating a “net risk” exposure .
Net Risk = Positive Risks (Outcome of Opportunities) + Negative Risks (Outcome of Threats)
Think of it the same way you think of the simple economic equation we use in business and even in our personal lives.
Profit/Loss = Revenue – Costs
In the same way you must jointly consider and manage revenue and costs to get a favorable profit picture, or to balance your household “books”, you must do the same for negative risks and positive risks to minimize net risks to your nonprofit’s business objectives. Fortunately the same concepts and tools used to manage negative risks can be applied to positive risk management. Therefore consider this to be something your nonprofit already does with negative risks and not a new thing.
I strongly believe that there is nothing new under the sun. Let me be clear. Positive risks are being managed today. They are just being managed based on the gut feelings of individuals and other ad hoc systems. They do not benefit from the visibility, systematic approaches, processes and toolsets that the negative risks have come to be managed by today. One way we observe this is when managers ignore warning signs and proceed, in the face of the “red” indicators we derived from only focusing on negative risks. Many times the managers are intuitively factoring positive risks in their calculations. They may not be as cavalier as they appear, once we factor the positive risks.
Does your nonprofit consider good risks? Are there any good risks on your risk registers?
Check out this great video on “how risks can be good”
Sex abuse and misconduct will not be tolerated – DFID
Regrettably, for all the good work that nonprofits do around the world, they have not been exempt from issues of abuse and sexual misconduct in the work place and towards beneficiaries. The last two years have brought to light many scandalous acts of sex misconduct and abuse that were perpetrated by humanitarian aid workers.
At a recent summit held by DFID (the UK’s aid agency), the issues were addressed in a series of papers and resolutions that provided guidance for international humanitarian aid agencies to follow. (See a summary at the link below).
In the #metoo era nonprofit auditors should also consider how to gain better assurance over such sensitive culture areas. They can bring all nonprofit work to a standstill.
Some questions. How is your audit function dealing with the topic? Can guidance provided by DFID and other agencies be useful for auditors, perhaps to establish an assurance baseline? Do we need more guidance from donor agencies, management and boards? Should auditors ignore such risks all together? If not involved in the assurance/checking work in this area, are those that are charged in your organization providing robust assurance?
My view is that auditors definitely need to engage management on the topic? Query how management is measuring the implementation of such guidances and of other countermeasures against sex abuse and misconduct. Auditors should follow up to ensure management has lived up to established standards and goals in the next years.
The scandalous nature of such issues, debases the work of all actors in the humanitarian sector. DFID’s call for collaboration amongst all agencies is to my mind vital to snuff out those involved in the misconduct and abuse and to address the cultures that look the other way.
See the below article that summarize the conference outcomes.
www.gov.uk/government/publications/safeguarding-summit-2018-hosts-outcome-summa
10 Things Keeping Nonprofit Auditors Up At Night – The NonProfit Times Article
What is on your audit plan for 2019? Have you begun to consider topics to address? Here’s a list of the top 10 challenges keeping nonprofit auditors up at night, and possible remedies (see link below) to help auditors continue their critical contributions to nonprofits.
- Changes to organizational strategy
- Organizational culture
- New technology
- Cybersecurity
- Compliance with funder requirements
- Financial controls
- Reliance on third parties
- Procurement procedures
- Transportation and distribution (logistics)
- Fraud and corruption
What do you think? I definitely agree with a good many of the items on the list.
In my experience the challenge is that nonprofit management and boards tend to constraint auditors to execute cyclical and compliance based audits of various organization segments/units and organization partners. This mostly out of habit and such audits tend to miss important entity level risks.
Click the article for more details and for some great proposed remedies. I might add that I know the authors well and they are quite knowledgeable about the challenges.
Source: 10 Things Keeping Nonprofit Auditors Up At Night – The NonProfit Times
The Journey Begins – the Nonprofit Auditor
Thanks for joining! Lets share the vast knowledge and insights that adorns our lives as auditors in the nonprofit space. Share news, experiences, best practices, what you learned to date, what you would really like to know.
I’m currently employed with an international nonprofit that many in the international humanitarian and development space may recognize (Save the Children US).
There has never been more opportunity and more lack of access for children. And I like being on the case to ensure the gap is bridged! So many other noble causes out there, that nonprofit auditors are “on” to ensure are accomplished.
Please share what excites you about being a nonprofit auditor. Maybe what today, has in the past or in the future inspired you. Join the journey.
Good company in a journey makes the way seem shorter. — Izaak Walton
Nonprofit Auditor 