Entries by Jason Rohlf

Rethinking the RCM

Much like fire and early man, the Excel-based RCM-to-Assurance Professional relationship has seemingly been in existence since the dawn of time (or at least the dawn of Excel). Thankfully there is a better way to manage this critical element of your assurance process. And you can do it without having to sacrifice what made the Excel-based approach so appealing in the first place—structured data, demonstration of key relationships, management of key attributes.

All Signs Point to Legal

From the perspective of the Legal professional, the demand on time and effort can be difficult to capture, organize and manage. Time is, as we all know, expensive. The Onspring Corporate Counsel solution allows Legal teams of all shapes and sizes to manage the requests, reviews and matters.

IRM vs. GRC: What’s in a Name?

IRM vs. GRC: What’s in a name? And what does this all mean? For many it means learning a new language and making old terms taboo. For others it means straddling both sides of the fence. And for others it doesn’t mean very much at all. Jason Rohlf explains.

SOX Status Check: Coordinating Compliance Efforts

Each of the primary groups impacted by SOX—Management, Public Accountants and Internal Auditors—has more clearly defined what role they play in the overall process, and this definition has been carefully and thoughtfully refined over time. And while we have reached a much more structured and stable point in the SOX lifecycle, it’s never a bad idea to revisit and refresh our understanding of why this structure works. A big reason why we find ourselves in this more predictable state is that all involved parties have a much better understanding of their specific role in the process.

Show Me: How to Build an Effective Control Testing Program

I believe you’d be surprised at the number of organizations that do not have a fully structured approach to evaluating the effectiveness of their system of controls. Whether their approach is not formally defined and communicated, inconsistently applied and/or inefficiently managed and monitored, they are at risk of not fully understanding whether their controls are meeting their stated objectives or worse, being completely caught off guard by a critical control failure that could lead to much more serious issues. To that end, we offer the following considerations as you evaluate the effectiveness of your control testing program.

Stocking the Shelves of Your Control Library

Organizations stand to benefit from building a standardized control library. Even the simplest data points you capture can become part of a very compelling story about how well (or poorly) your organization is meeting its objectives. And organizing this library in a systematic and structured way allows you to keep that critical knowledge at your fingertips and answer compelling questions at a moment’s notice.

31 Flavors of Compliance

Common supports remain in place, even as regulations and best practices evolve. Remember this as you stand at the metaphorical “ice cream counter of compliance.” The sheer variety and complexity of requirements can be overwhelming, but the core people, processes and technologies you engage to understand and address those requirements remains largely the same.

GRC Groundhog Day: Same Thing, Different Result?

Your organization must place its primary focus on the execution of the critical GRC processes that have been vetted and validated. That said, as you ride the ebbs and flows of your business, it is crucial to perform periodic assessments of your processes to make sure it’s giving you what you need. Keep in mind that this does not merely involve reviewing your process documentation, making a few tweaks, and calling it a day. Rather, you should focus on asking yourself some tough questions.

Some Things Never Go Out of Style

Despite the changes that swirl around us each and every day, there are some things that thankfully remain constant. Integrity, focus on the customer’s needs, a desire to solve problems no matter what obstacles present themselves, respect for our fellow humans—these principles have served us well over time and continue to hold up in the present day.

5 Ways Internal Audit Can Add More Value

The internal audit profession has long called upon itself to add value to the organizations it serves. It’s not just about performing audits, testing controls and issuing reports. Internal audit is expected to use its unique position within the organization to take the collection of individual pieces and parts and build a comprehensive view of the company and provide valuable guidance on the strengths, weaknesses, threats and opportunities that the organization must navigate in order to succeed.