Briefing
An audit has value because it is objective. When one company designs, operates and reviews the same systems, the review loses that objectivity.
Regulators have addressed this for years. The FFIEC IT Examination Handbook flags potential conflicts when an outsourced auditor also provides IT or consulting services. The interagency policy statement on internal audit outsourcing warns against a firm appearing to audit its own work and says audit providers should not make management decisions. HHS notes a HIPAA evaluation can be internal or external, and that private Security Rule certifications are not recognized and do not remove an organization's obligations.
Customers, partners and prime contractors increasingly ask who reviewed the controls, not only whether controls exist.
What to do
- Assign two roles: the operator runs systems day to day; an independent assessor evaluates them.
- Require the operator to maintain evidence continuously: policies, configurations, patch history, access reviews and tickets.
- Contract the assessor directly and receive findings directly.
- Treat findings as input to the operator's work plan with dates and owners.
How to verify
- Check whether any vendor both runs and assesses the same environment.
- Measure how many document requests the assessor had to make. Fewer requests means the evidence was ready.
- Confirm last year's findings are closed or have accepted risk decisions on file.
Sources
- FFIEC IT Examination Handbook, Audit booklet: Outsourcing Internal IT Audit
- Interagency Policy Statement on the Internal Audit Function and Its Outsourcing
- HHS FAQ, Are we required to certify our organization's compliance with the Security Rule?
Want help putting this in place? Contact Computer Plus.