Inside: - Media Communication Group

on the effectiveness of the controls over their production. Aclassic example of inspection used to test controls is inspectionof records for evidence of authorization.Authorization is a critical control requirement within anaudit. Documentation evidence includes requesting, approving,reviewing and modifying or changing an authorizationcomponent or the authorization in its entirety and the supportingdocumentation must evidence that the transactionis appropriate, accurate and complies with applicable laws,regulations, policies, and procedures. An entity’s policies andprocedures are often considered essential evidence of controldocumentation and a link between the entity’s vision andday-to-day operations, allowing employees to understand theirroles and responsibilities within predefined limits. Policies andprocedures allow management to guide operations withoutconstant management intervention and set expectations ofemployee behavior.For example, given these statements, the documentation evidenceassociated with authorizing an employee to have accessto a computer likely includes:• Policies & procedures• Authorization request mechanism(s)• Reviews for request appropriateness• Request authorization by appropriate resources• Request establishment within approved limits• Periodic review that access is still valid• Appropriate action to amend, modify or eliminate access.In aggregate, you can see there is a significant amount ofdocumentation in paper and/or electronic form for this oneexample of compliance documentation.Organizations can become overwhelmed with the upkeepand maintenance all of the documentation needed to evidencecompliance. The risks of not having up-to-date, complianceready documentation has grown into an enormous problemwith fines, loss of business revenue, reputation or even civiland criminal penalties becoming more prevalent.Many organizations realize that their technical staff’s timeand energy is not well spent on creating and updating documentation- efforts they typically dislike. Additionally staffstruggles to monitor and enforce compliance when it comesto routine tasks or control activities. When not a valued useof time often the end result is insufficient or inappropriateevidence, especially when audits are pending or underway andrequired evidence is lacking. For more informaon, contact Suzanne Farr at Terra Verde Services at877-707-7997, ext 7 or suzanne.farr@terraverde.net. Suzanne is theChief Operang Officer of Terra Verde Services and has over 30 years ofIT, operaonal and audit experience.ARIZONA BANKER Spring 2013 23