Course: Evaluating Vendor Risks – Do you know if they have controls?
Description: This seminar is designed to educate participants regarding the nature of vendor risk and the mechanisms to effectively manage and control those risks. Over the past 20 years, SAS 70 has been the primary means of evaluating controls at service organizations. However, the limitations of the standard have left management and auditors with the need to perform additional procedures to address the concerns of management, clients and regulatory authorities. As a consequence, these additional assurance activities have increased audit costs and introduced significant inefficiencies. New mechanisms have been developed to satisfy not only the needs of auditors but those of management and regulatory entities as well. During this seminar, we will explore some of these new standards and will consider an enhanced framework for evaluating risks at service providers.
Key Topics:
• Overview of outsourcing arrangements
• Rights to audit
• Diversity of service organizations
• Assessment mechanisms
• SAS 70
• Shared Assessments
• ISAE 3402
• SAS 70 No More
• Conducting an assessment engagement
• Using a third party assessment
• Project management considerations
CPE: 7
Who should attend: financial auditors, IT auditors, IT personnel, business development professionals, information security professionals and any other professional interested in learning more about risks and controls at service organizations and the mechanisms to evaluate them.