Control Effectiveness Assessment: Criteria, Evidence, and a Scale Two Assessors Can Share ler

Isbn 13: 9798170543489

djvu Control Effectiveness Assessment: Criteria, Evidence, and a Scale Two Assessors Can Share

por

Escolha um formato:

Escolha um formato:

zip ler
rar ler
pdf ler
epub ler
txt ler
djvu ler

Descrição do livro

A control is effective when it is well designed, the people who run it are able to run it, and someone is checking that it runs and learning when it does not. Rate each of those three things on a five-level scale with published descriptors, take the lowest as the rating of the control, and report all three.

That is the method. The rest of this book is what it takes to apply it so that two assessors, given the same evidence, reach the same answer.

Most control failures that reach a public inquiry were rated effective on paper. Piper Alpha had a permit procedure, daily monitoring, and a corporate audit that found no deficiency. Wells Fargo had a code of ethics, a sanction for the conduct, and an internal audit function that largely found the relevant controls effective. The documents were never the problem. The problem was that the documents were what the assessors were shown.

This is a reference, not a narrative. It gives you:

  • A definition of a control and of effectiveness that you can hand to an owner before you collect evidence
  • Three pillars — Policy (design), Assurance (capability), Compliance and feedback (verification and learning) — and the rule that the overall rating is the lowest of the three
  • A ten-step assessment process that does not change when the assessor does: self-assessment, independent internal assessment, or external review
  • Criteria libraries, an evidence standard that puts practice above paper, and a five-level scale with observables a second rater can check
  • Findings in four parts and recommendations that are appropriate, actionable, achievable, and agreed
  • Full worked assessments of Piper Alpha’s permit-to-work system and Wells Fargo’s sales-conduct controls, plus shorter notes on Challenger, Texas City, Robodebt, and Enron
  • How to design and validate a self-assessment program without pretending that a first-line rating is assurance
  • Templates, calibration exercises, and a one-page board report

The method is the same whether you own the control or you have been asked to test it. What changes is the evidence the reader will demand.

If you read only three chapters, read the anatomy of a control, how to rate one, and the Piper Alpha assessment. Then use it on Monday.

Número de páginas :286
Isbn 13 :9798170543489
Encadernação Control Effectiveness Assessment: Criteria, Evidence, and a Scale Two Assessors Can Share:Capa Comum
Livros relacionados