ICYMI: Assessments and Scoping in policyIQ

Did you miss our recent training session on completing our SOX Risk Assessments and scoping exercises in policyIQ?  Not to worry – we have you covered!

How Can I Catch Up?

If you want to get into the details, we have the training session and materials available for download!

  • You can access the slides here.
  • You can also view the recording from our policyIQ training page.
    The training page is linked from your policyIQ login page – and available from within the online Help Guide.  If you don’t have access to the training page, please reach out and we’ll send you the link!

Just the Highlights, Please!

This training session aimed to ensure that participants are able to…

rascope1

We discussed common SOX risk assessments at the financial statement line item level, targeting risk factors like…

rascope3

In addition to illustrating how to create the calculation directly in policyIQ, we also acknowledged that some folks love their MS Excel process.  policyIQ can handle that, too, through the import option!

rascope4

Then we took a close look at the relationships between the content that allows for the most effective scoping options.

rascope2

And finally, we walked through the reports that provide the final step in the scoping process.

rascope5

We would love to help YOU get started on your risk assessments in policyIQ, so that we can link into your SOX work for ease of annual scoping.  Contact us today and we’ll meet with you at no cost to help you get on your way!

Our next great feature: Linked Fields in policyIQ

Does the task of updating control documentation in more than one location seem redundant and a drag on your day?

Changing the description or general governing details of any page in policyIQ can create a wave of changes that need to be made in other places in the site.  Wouldn’t it be great to make the update once, and have that update be reflected everywhere?

It definitely would be.  Consider it done!

linked_fields_test_example2

The next update of policyIQ will include a new field type: Linked Fields.  This field will be a field that is auto-populated with the data from an existing field  on a linked page.  For our SOX and Audit clients, think about things like control descriptions.  These descriptions are periodically tweaked, and that change needs to be reflected anywhere the description appears.  We’ll create a linked field on our test result pages that are likely linked to this control page, and point it at the description of the control page.  Because of this setup, the control page can be updated, and the test page will automatically pick up those changes.

Add_Linked_Field.png

Creating new linked fields is easy, and it’s coming to your policyIQ site in the next few months!  Please contact us with any questions or thoughts on how you may take advantage of this huge new feature.

 

Efficiency Throughout the SOX Process

In a number of blog posts, we’ve highlighted the ways that policyIQ can be used throughout the entire SOX process – from risk assessments through issue remediation.  This past Thursday, July 28th, we took an hour to walk through the entire process in a CPE webinar to highlight ways to create efficiency at each step.

Did you miss it?

Before we hit the highlights below, we want to point you to the session recording and the slides, both of which are available for download.

The Big Picture

We highlighted a number of big picture advantages of using policyIQ not just for SOX, but for all of your compliance initiatives.  We talked about…

  • Simplicity of rolling out and managing a cloud-based
  • Advantages of being able to assign security and access
  • And the efficiency of a single source of information through the entire compliance and audit environment.

A single source means that when you make a change in one place, that change feeds all of the different perspectives on the data.

Controls

Efficiency at Every Step

We also dug into the efficiency that can be gained at every step of the process.  Just some of those ideas are presented below.  We also mentioned additional training available for some steps, and have linked those training sessions.

process

  1. Risk Assessments
    • Tie risk assessments at the 10K line item level to your risks and controls for ease of scoping.
  2. Control Updates & Review
    • Allow your control owners to make updates directly in policyIQ as things change, or require regular reviews of control documentation.
  3. Walkthroughs & Testing
    • Collaborate early (and often) with external auditors to ensure that your testing is capturing all of the detail expected.
  4. Issue Tracking & Remediation
    • Assign remediation plans to owners and use automated reminders to ensure responses are provided.
  5. Conclusions & Reporting
    • Utilize flexible reporting capabilities to trace issues back to the vulnerable risks and compensating controls to make a final determination about significant deficiencies or material weaknesses.

 

We also included the supporting functions that feed the process.

 

We’re ready to help you build more efficiency into your SOX program.  Contact us today and ask to speak with our client service team to walk you through implementing some new ideas!  Not yet a policyIQ client?  Contact us and ask us for a personalized demonstration!

Save time with Audit Evidence Collection in policyIQ!

For many years, we have been encouraging our clients to utilize policyIQ for all aspects of their compliance programs – from the assessment of risk through the remediation of issues.  However, during a recent conversation with long-time client, Travis Heyer (Director of Internal Audit at Great Lakes Dredge and Dock), we realized that we had not yet clearly illustrated in a live training session how to effectively request and capture audit evidence within policyIQ.

Travis graciously agreed to work with us to create a training session – and brought his colleague, Amit Patel (Senior Auditor) along with him.  On Thursday, March 31, we presented this session to a large number of very active participants.  (You can check out the recording of the session, or download the slides for a quick overview.)

quoteHeyer

It’s really all about saving time

Automating the requests for audit evidence can allow your internal audit team to…

  • Avoid playing “Match the evidence to the request!”
  • Minimize risk of using an old version of a file
  • Waste time sending annoying follow-ups
  • Secure documentation more effectively

It comes down to a huge time savings, freeing up internal audit resources to do the real, value-add work that your organization needs.

Pages or Forms?

While the training presentation focused on an evidence collection process in policyIQ pages, a similar process can be built within policyIQ forms.

evidencerequest

Pages offer the advantage of a two-way link between the Evidence Request and the Test page, so that your internal auditors can simply leave the files attached to the Evidence Request.  Pages also allow more than one individual user to contribute directly to the same Request.  However, utilizing Pages requires that all users who participate in the process of providing evidence are Advanced Users, a more expensive license in policyIQ.

Forms offer their own advantages, allowing for a simple issuing and follow-up process.  However, the link between the Evidence Request form and the Test page is less visible.  Evidence files will need to be downloaded and re-uploaded to the Test page by the auditor.  The significant advantage of the Forms process is that any individual providing evidence needs only to have a Standard User license, a less expensive license that can keep costs low!

Getting started in 5 easy steps

Our training session focused on how to get started in just five easy steps:

  1. Create Evidence Request template
  2. Build list of evidence in Excel
  3. Import evidence request list
  4. Assign requests
  5. Track progress and follow-up

We encourage you to check out the recording or the slides for more details on these steps – and reach out to us to help you to get your bearings and get started!

New Company, New Controls: policyIQ Handled it All

Any quick look around the marketplace reveals that companies big and small are constantly acquired, bought, sold and merged on a constant basis.  Many of these public companies then have to figure how how their SOX compliance will be affected, and this can put a ton of stress on the audit teams that bear the responsibility of “making compliance happen”.

Fortunately for companies using policyIQ that have purchased or merged with others, the SOX issue goes from, “Can we make this transition in policyIQ, as well?” to “WOW.  That was pretty easy!”

A recent long time policyIQ client acquired a company, and each had their own set of risks and controls.  Ultimately, their goal was to combine these two separate entities into one SOX environment, and easily distinguish between SOX work from Company A and Company B.

entity.png

Our team and product made this easy.  To begin, we simply added a single-select field on their controls and risks called “Entity”, with options for Company A or B.  By doing so, we created an  easily reportable way of sorting content from one company to another.  This was conducted by an Import to Update (via an Excel document), meaning that much of the work was easily done in a simple spreadsheet offline.  Simple!

All new documentation from Company B was then mass imported into policyIQ a few days later.

Entities.png

Some companies might like this arranged differently, and that makes total sense.  We had discussed using additional folders to distinguish the risks and controls from company to company.  Advantages?  One less field per page, and a more organized folder structure-less content per folder.  Disadvantages?  There are more folders, and some folks like a really simple structure.  A difference in results or reporting?  None!

Do you feel like you should partner with a policyIQ expert to work on your SOX work this year?  Do you have  a couple of ideas you’d  like to run by us?  Send us an email!   Support@policyIQ.com

It’s true! policyIQ is a misfit among typical software providers.

Have you been burned by a software provider?

Sheesh—who hasn’t?!

You worked for months (years for some), listening to promises from several different people who kept handing you off and never addressing your concerns. You found yourself with more time and money invested than you care to admit and you have grown to look at all software providers with skepticism (if not disgust).

Does this sound familiar?

I hear you. Your frustration was echoed by countless people that I spoke with at a national conference in March. Because a number of people felt compelled to share their horror stories about other providers with me, I got comfortable jumping quickly to the things that make us different than the typical software company:

  • All-in-one_BubblesRGP is NOT a software company! Integrity is at the core of our firm. We want to create great relationships and serve you so impressively that, when you need a consultant, you already know the quality that you can expect from us.
  • We don’t have a huge policyIQ booth at conferences and our software does not have the huge price-tag required to pay for that presence (policyIQ starts at <$5k/year).
  • We don’t sell multiple modules or products and aim to upsell you. policyIQ really does accommodate multiple business areas and needs in one affordable tool.
  • Our goal is to solve for your information, content, process, and workflow challenges across the Governance, Risk and Compliance (GRC) space, not to land a sale.
  • Your sales person does not make commission or hand you off to an implementation team that’s unaware of promises made during the sales process—we walk alongside you the whole way and help to tailor the implementation to your organization’s needs.
  • Our product does what we tell you it does (and we answer truthfully if you ask us about something we don’t do or plan to develop).
  • We have a support team that truly cares to give you excellent and timely service.

We think of our clients as part of our community with whom we will have a long partnership. We listen to your needs, plans, wishes and heartaches and work continuously to problem solve with you.

We’re proud to be a misfit among typical software providers.

pIQ_Misfit_smWe’re ready to prove it and to earn your trust.

We encourage you to take a peek at this introduction to policyIQ, and then reach out to us!  We’d be glad to schedule a personalized tour of policyIQ. Also, we invite you to kick the tires! Sign up for a 30-day trial, completely risk-free.

We look forward to working with you!

Which part of your SOX program do you want to improve this year? This list of resources will help.

Soup to nuts—or Risk Assessment to Review of Evidence, we are ready to help you make your 2016 Sarbanes Oxley compliance work more efficient than ever! You will notice that we have another post this month that talks about rolling forward last year’s SOX work to create the baseline for your 2016 work. Some of you might not want to repeat last year’s work. Maybe you didn’t use policyIQ last year or you’d like to make improvements on what was done in previous years and take advantage of all that policyIQ has to offer. We have some tips and tools to help you:

chart1

  • Risk Assessment – We previously shared a sample template with you that you might want to implement for 2016. If you already have your Financial Statement Risk Assessment complete, we can help you with your plan to import and tie the results of that assessment to relevant assertions and controls. Capturing the full cycle in one place will not only help your organization to be much more efficient, it will also save time and money when your external auditors are looking to connect.
  • PCAOB’s Auditing Standard No. 5 – Are you looking to make improvements to your process and work more efficiently this year? Check out this visual summary or watch the full recording of the webinar that walks through the application of AS5.
  • chart2Link related compliance elements and utilize various reports to monitor progress, analyze performance, and stay on top of your program. We have lots of ideas about SOX reporting. Check out you online Help manual and this post for some ideas.
  • Automate supporting processes – are you still using Word, Excel, and email to manage your 302 Certifications, Control Self Assessments and Narrative Reviews? One of the most frustrating parts of this work is having to inventory the responses and pester people to get their work done. You can literally perform the setup of these tasks one time and then consider it complete forever after using policyIQ’s Forms functionality to automate the inventory and reminders.
  • consultantsGrant External Auditors access to only that content which you want them to see! Have you done this yet? I recall being scolded by a client who told me that we don’t brag about this benefit enough. He felt that he could have saved a significant amount of time and money over the years and wished he had granted their external auditors access much sooner. It’s really easy to bring them into the fold and show them only what you want them to be able to review. Here’s how.
  • Evidence gathering – If you find that a lot of time is spent by auditors, managers—everyone—rounding up information, perhaps it is time to commit to one main holding place for your evidence. You can even use policyIQ to help automate and monitor the collection of evidence. We have some posts discussing what has been done in the past and we’ll be taking a fresh look at options surrounding the Evidence Collection effort in an upcoming training session—please join us!

E012649We hope that this list of resources is helpful to you or at least has you thinking about things that you’d like to manage more efficiently. We often work with people who feel like they just don’t have time to figure out how to save time! We get it. That’s what we’re here for! If you don’t have time to read posts and play around in policyIQ, but want to realize the benefits sooner than later, reach out to us and we’ll walk you through some simple adjustments that you can make to gain relief and command over your information right away!

Stop Costly Mining of Information for Each Audit

Many organizations have seen a shift in their SOX environment in recent years. SOX has become commoditized and leadership is concerned about buckling down on the level of work and on the cost of SOX. While many companies have reviewed, rationalized and streamlined their controls down to a more manageable level, focusing on testing only the key controls amounting to less than 150 in most cases, we still see that many have not entirely streamlined their management of the full cycle of analysis and documentation. Have you?

  • FinancialStatementsWho performs your Financial Statement Risk Assessment? Where is the documentation of that process and the conclusions regarding significant accounts and relevant assertions kept?
  • Have you plainly identified and documented your Financial Statement Risks and are you able to demonstrate which Controls are critical to their mitigation?
  • Of course, tests are being performed; but how are you tracking the evidence associated with those tests and does it seem that the process of defining and assigning audits is as efficient as it could be?
  • Do you have historical record of your audit findings, issues and methods of remediation? Can you easily review and determine the most cost effective approaches to remediation?
  • Can you pull up evidence of COSO coverage as simply as you can share your Risk-Control matrix?
  • Apart from the staples of SOX documentation, where do you document things such as considerations and assumptions for key decisions, exceptions or overrides?

Probably the most simple question yielding the most telling answer regarding whether your SOX program is as effective and efficient as it can be is this: do you perform and maintain all of this documentation in one system or is it someone’s responsibility to mine information and evidence for each external audit? piggybankIf each of these processes is happening in different mediums, stored in different repositories and managed with a wide range of workflows and procedures that are in place simply because “it’s always been that way”, then you have a significant opportunity to save time and money while more effectively managing your SOX program and, therefore, improving the bottom line of your company.

Of course, this message is for those organizations that have yet to bring automation and the power of a database to their SOX processes and documentation. Still, this message should not be lost on the many policyIQ clients who already experience how easily the collaboration of work, hand-offs, review and approval can be managed in policyIQ. We work with many companies who still have portions of their SOX cycle in various systems. Aside from the plain-to-see expense of paying for many different systems, there is cost associated with ongoing maintenance, training, and the time required to bring all of the information together and to relate the key components that paint the picture of an effective internal control environment.

Reach out to us and we’ll provide you with a free demonstration and configuration guidance on streamlining the various segments of your SOX program into one efficient and manageable cycle. We can schedule your configuration session within the week and have you up and running in the next 4-6 weeks! Talk to you soon!