grc summit 2013 apr 30 - may 1, 2013 | mandarin oriental, las vegas, nv © metricstream, inc. |all...





ENGAGE | INSPIRE | TRANSFORMAneesh Bhatnagar

Associate Director – Product

Policy and Compliance Management

Aneesh Bhatnagar

Policy & Compliance Management




Agenda1. Policy Management

2. Compliance Management




PolicyManagement




Topics1. Policy Management

2. Product Overview: Key Features

3. Policy Development

4. Policy Maintenance

5. Policy Communication

6. Policy Implementation & Enforcement

7. Reports / Dashboards




GRC




GRCPolicy Management helps set the principles/ rules to guide decisions (set the governance objective & procedures) to achieve compliance on these objectives




Policy Management

Determine the Need

Develop & Maintain

Communicate

Implement & Enforce




Key features of Policy Management1. Ability to create Inline as well as Document based policies





2. Ability to link policies/sections to relevant GRCF objects






3. User Configurable workflows







4. Audit Trails







4. Audit Trails

5. Powerful Policy Search







4. Audit Trails


6. Granular Access Controls







4. Audit Trails



7. Supports for policy management lifecycle







4. Audit Trails




8. Ability to control the number of copies that can be printed







4. Audit Trails





9. Automatic conversion of the final policies into PDF along with the header, footer, e-signature & document information







4. Audit Trails






10. Sophisticated dashboards to monitor the policy management







4. Audit Trails






10. Sophisticated dashboards to monitor the policy management

11. MLS enabled




Create Document based policies

Any user defined in the first stage (i.e. the author stage) of the lifecycle can initiate a policy creation process

Select the lifecycle and the category/ sub-categories

Modify the stage level users.

Upload the controlled policy document




Map it to other GRC Content

The author / reviewers can relate a policy with GRCF Objects to set the Policy / Procedures for one or many GRCF Objects




Review / Approve Document based policy

The Reviewers can access the Policy using the View, Download, Print, Upload Privileges

Reviewers can select the reviewers of the next stage based on the appropriate privileges

Can have ‘n’ number of stages based on how the lifecycle is setup




Create Inline Policy

Create a policy in sections.Each section can relate to a GRCF object

All the sections will be exported to Word and the Policy Users will get a complete view of the policy

The author can choose to send the section to a reviewer / approver




Review & Approve Inline Policy

Each approver / reviewer will be shown the section that he needs to approve

He can choose to approve or reject a section

Once all the sections are approved / reviewed, the policy will get published.




Policy Maintenance• Major Change - When an existing policy needs to be changed

significantly

• Minor Change - When an existing policy needs to be undergo a small modification

• Policy Obsoletion - When an existing policy goes out-of-date




Policy Maintenance : Upversion

Option to change the lifecycle while upversioning the policy




Policy Maintenance : Change Request

Select the Option Change Request.

The policy routes through all the stages of the lifecycles and once published will be available to the end users




Policy Maintenance : Change Request

Policies can be obsoleted by initiating the policy Obsoletion process

Obsoleted policies are not available to the end users




Policy Communication

After a policy is published, the policy can be sent out for Policy Communication.

All the policy users of that specific policy will receive an email notification with the link to provide their feedback.

The policy users can access the Policy and can either accept or reject the policies

The acceptance or rejection of the policy is retained in the system and can be produce as an evidence




Policy Attestation

The Policy users can either accept a policy or Request for exception and provide their comments

The attestation information provided by the policy users are available in the policy management reports




Policy Discovery

Policy discovery can be done in two ways• Browse – In a windows

explorer like tree view • Search – Using the search

filters




Reports

• In-process Policy Documents Report

• Approved Policy Documents Report

• Obsolete Policy Documents Report

• Audit History Report• Policy Management Reports




Audit History




Dashboards

Dashboards for • Policies in the lifecycle• Published Policies• Policy Access • Policy Attestations

Provides drill down from each of the dashboards to list additional information like the number of people who have not attested, who have already attested etc. with an option to export these details




Multi Lingual Support




Regulatory Changes




GRC Intelligence




ComplianceManagement




Compliance Management

Policies Regulations

AOC

Controls

Processes

Standards

Objectives




Compliance Management

Policies Regulations

AOC

Controls

Processes

Standards

Objectives Functions

Assets

Questions/Procedure

Evidences

Exceptions

Financial Account

AssertionsAuditable Entity




ONEF L E X I B L

EDATA MODEL




Flexible Model that helps test

NOT just Controls




Leverages Harmonized Content

from GRC Library




GRC Library linked to

your Policies




Supports correlation between Controls

and Question




Integrated with Issue and Action Tracking

System




Create Adhoc Tests




View Prior Test Results while

performing Tests




Calendarto view

Task Schedule




UploadTest Plans




1. Flexible model that helps test not just Controls

2. Leverages Harmonized Content from GRC Library

3. GRC Library linked to your Policies

4. Supports correlation between controls and questions

5. Integrated with Issue and Action Tracking System

6. Easily create ad-hoc tests and assign to individuals (without creating a full-blown plan)

7. Provides access to prior assessment data while doing the assessment.

8. Calendar to view Tests, Surveys & Certifications

9. Upload Test Plans

10. Out of the Box Reports & Dashboards

Summary




The Year 2012What we did




2012…1. Advanced Testing Framework

• Enhances planning and scheduling• Enables proactive detection of non-compliance• Sends Surveys and Certifications to Users, Roles, Control and

Process Owners

2. Regulatory Compliance Dashboard• Allows the compliance manager to track control failures and

sample failures for every Area of Compliance, Type of Area of Compliance and at an Organization level

3. New Reports• Failed Test Report• Not Tested Report• Line Items with key controls with no Test Plan• Compliance Status by Organization

4. Data Upload

5. Multi lingual support




Regulatory Compliance Dashboard




SOX Dashboard




SOX Report




SOX Score Card

Total # Of Controls

Controls Tested / Not Tested

Controls Missing Test Plans

Controls Failed / Passed

Overdue Tests

Issues – Open, Overdue, Closed




The Road Ahead2013




The Road Ahead – 2013…1. Create Requirements from Policy

2. Support for Testing Control Objectives and Standards

3. Test Controls and Process related to Objectives, Standards, Regulations, AOC, Policy etc

4. Integration with PDMS and Surveys Module

5. Link Evidences and Exceptions during Tests

6. Automated Sample Size Calculation

7. SOX Scoping

8. Simplified Self Assessment

9. Mass Reassignment

10. Automated Issue Creation for Failed Tests

11. Remediation Testing

12. Validation Testing

13. Enhanced Reporting and Dashboards




Test Standard & Objectives




Add Exceptions to Test




Attach or Link Evidences




View Exceptions and Evidences




Test Status Report




The Vision2014 and Beyond




The Vision – 2014 and Beyond…1. Roll over Tests

2. Test Compliance of Products, Projects etc

3. Mind Map Style Visualization of Controls and its connections

4. Simplified Control Testing User Interface

5. Continuous Control Monitoring





Q u e s t i o n s a n d D i s c u s s i o n ENGAGE | INSPIRE | TRANSFORM[Presenter Name]

[Presenter’s Contact Email ID]

grc summit 2013 apr 30 - may 1, 2013 | mandarin oriental, las vegas, nv © metricstream, inc. |all...

Documents

transform grc summit

nv metricstream grc

las vegas

mandarin oriental

transform grc slide

policy communication

policy maintenance

policy development