Determining the right sample size for IT controls testing, Insights into industry standards / best practices

For manual controls, the frequency of the occurrence of the control is taken into consideration (daily, weekly, monthly, quarterly, and yearly). Also taken into account are the risks placed on the control (High/Medium/Low) and other factors based on the understanding of the control environment. These factors, listed below, drive the auditor to select a higher sample size

1. Complex controls prone to failure.
2. Controls where the significance of the judgments must be made in connection with its operation.
3. Controls over significant processes where the assessed risk of failure of the controls to operate effectively is higher than normal.
4. Controls that have a pervasive effect on other controls or processes.
5. Controls that are relatively more important (e.g., some controls may address multiple control area components).
6. Controls that are not protected by multiple layers of redundant controls.
7. Controls recently implemented or remediated.
   

Alternatively develop a simple matrix to select your sample size based on the risk ranging High-Medium-low and sample size also from small to high. 

The Modified Pareto's principle is also used for sample selection. In this, if the sample size exceeds 20 then random 20% of the dataset as sample size. If the number is <=20 take 100% as sample size. The dataset size/population is for the period under consideration (preferably >=quarter).

Another factor affecting sample size selection is the appetite for risk of organization to start with. Assess the risk and subsequently that would determine the amount of testing to be done.

There should be a separate plan to select controls that are being retested and this calls for a minimum time period and a minimum number of samples to be tested. For example...If a Daily Control is being retested there must be a minimum 20 day test period with a minimum of 10 samples pulled.

For automated controls reduce the sample size to what is appropriate to audit risk. If this is an environment that has a “good history” of audits IT Controls that have traditionally demonstrated high compliance ratios then the sample size is reduced based on good judgment. However, every automated control has some risk of failure and hence one needs to vary the sample size accordingly. It is also important to auditors that automated controls are operational and effective since this will provide assurance to auditors that information generated from the system is valid, accurate and complete. Based on this assurance from the system, auditors can then place the appropriate level of reliance on the controls of the information system. 

Governance, Risk and Compliance or "GRC" is the umbrella term covering an organization's approach across these three areas. Being closely related concerns, governance, risk and compliance activities are increasingly being integrated and aligned to some extent in order to avoid conflicts, wasteful overlaps and gaps.

For many enterprises, compliance is time consuming and costly, and is viewed as a cost of doing business. However, some IT organizations have lowered their on-going compliance costs by centralizing their compliance and risk initiatives. But more importantly, these companies with centralized compliance initiatives are better positioned to benefits in the future by leveraging and extending their efforts to improve their operations and effectively manage compliance initiatives.

Cost, Efficiency, Flexibility

Cost Management, Efficiency and Flexibility have always been prevalent themes in business. In the risk and compliance management space, these three trends have come to the forefront:

• Reduce costs
• Improve operational efficiency
• Utilize flexible frameworks as the basis for building sound programs

Many companies have turned to a risk and compliance management strategy and supporting infrastructure that can grow with their organization as their needs change. Using this platform approach to Governance Risk & Compliance (GRC) not only increases efficiency and drives down cost, but also ensures that the demands of the risk and regulatory landscape are met today and tomorrow.GRC strategies look to streamline these efforts and manage risks more efficiently.

Cost Cutting Considerations

While companies are trying to cut costs, it is important to understand the factors and end results associated with reducing risk management programs when deciding where and how much to cut. All too often compliance is overlooked as a key piece of the risk landscape when it is critical for the success of Governance, Risk & Compliance (GRC) program.

A Governance, Risk & Compliance (GRC) platform that brings compliance and risk management together can not only bring efficiencies to the organization but also, can be leveraged to understand the impact of cutting costs. Reducing investments in the Governance, Risk & Compliance (GRC) areas may have short term gains with serious long term negative impacts. Better business decisions can be made when risks are put into perspective and the quality of risk data is improved. These types of decisions must be weighed carefully.

Finding the Right Balance

Finding the right balance of controls originates from a well-run risk management process. Before deferring investment in new technologies and reducing staff, the risks associated with these reductions have to be understood. Designing controls around these risks can ensure that reductions aren’t met with increased risk in business-critical functions.

Companies that have switched to automated Governance, Risk & Compliance (GRC) approach have found analysis that previously required months of research can be done in minutes - and with much greater detail. Automated Governance, Risk & Compliance (GRC) technology can streamline policy management, while taking into account compliance controls.

Getting value for your Governance, Risk & Compliance (GRC) Investment

There are three main categories of Governance Risk & Compliance (GRC) initiatives to consider:

• Governance, Risk & Compliance (GRC) Research and Development is based on understanding regulations, risk management approaches and control frameworks and mapping the relevant business requirements to the company’s operations.
• Governance, and Policy Management is focused on properly communicating and enforcing governance and risk management policies and controls across the enterprise.
• E-GRC Management and Reporting measures the overall corporate environment against established controls emphasizing reporting and analyzing trends, as well as remediating risks and incidents with mapping back to root causes.

By identifying cost savings and improved operational efficiency, companies can justify the cost of Governance, Risk & Compliance (GRC) technology and demonstrate rapid ROI. Even modest Governance, Risk & Compliance (GRC) programs can be very expensive when they are based on manual processes and niche technology solutions.

Conclusion

Thinking strategically and establishing a scalable framework to meet future requirements is a lot more beneficial than one-off, “quick fix” remediation plan. E-GRC technology can replace disparate, inefficient, manual tools and processes. To leverage knowledge throughout the organization, controls must be managed and collaboration increased. Automation is a key factor in managing and communicating policy adherence. So when companies can’t decide what to cut, what to keep and where to invest, they need to think about both the risks and the rewards.