An auditor visits the business
Almost every organization has an IT auditor (read: auditor, accountant, tax authority) who visits periodically to check whether everything is still running according to regulations. A few days or even weeks before the visit, a section of the organization is interviewed and asked to gather and submit information. Then the auditor arrives, sometimes accompanied by a few junior staff members; they assess whether “everything is in order.” Or, will they even come at all? Many accounting firms appear to be stopping statutory audits (source: FD) due to high regulatory pressure.
Incidental versus continuous auditing
Increasingly, time and money are invested in such snapshots; usually, something is wrong. After the visit, time is spent correcting the situation, and then peace returns… until the next periodic inspection. Between inspections, the organization is increasingly in violation or even non-compliant.
Especially when a violation or non-compliance is related to finances or safety risks, a structural solution is desirable: Continuous Monitoring in combination with Continuous Auditing.
Ideally, systems should continuously monitor for violations and, if necessary, report them. Preferably, the appropriate people should be notified so immediate action can be taken. The gap between technology and monitoring plays a role here. Many systems, without realizing it, contain source data for Continuous Monitoring and Auditing.
Knowing where to find the information, retrieving it and then presenting it in a usable form is the challenge!
Good IAM has Continuous Auditing
A well-designed IAM environment always contains an up-to-date overview of (the relationships between) people, identities, groups, rights, and permissions, as well as their history. Your IAM therefore has great potential as a supporting tool that performs granular and automatic checks based on your rules. Using reporting options and notifications, (non-)compliance is tracked, and violations can be prevented or addressed immediately. The audit is therefore continuously maintained by IAM through reports and notifications, and by continuously monitoring your IAM, you elevate the integrity of your data.
Your IAM already has the necessary data; Continuous Monitoring and Auditing present the data in a coherent whole. The right IAM tool is therefore your daily IT auditor, already having everything in order and organized when the auditor visits. Your employees are relieved of the burden and can focus on other matters.
Revish Basropansingh
IAM Consultant