MO03 Assurance Reviews

Monitor internal control, assessing their effectiveness, and reporting on them on a regular basis.

Independent Security and Internal Control Certification/Accreditation of IT Services: obtaining independent certification/accreditation of security and internal controls (including all external service providers) prior to implementing critical new information technology services and re-certification/re-accreditation of these services on a routine cycle after implementation
Independent Effectiveness Evaluation of IT Services: obtaining independent evaluation of the effectiveness of IT services (including all external service providers) on a routine cycle
Independent Assurance of Compliance with Laws and Regulatory Requirements and Contractual Commitments: obtaining independent assurance of the information service function’s compliance (including all external service providers) with legal and regulatory requirements, and contractual commitments on a routine cycle

Index of senior management satisfaction and comfort with reporting on internal control monitoring
Decreased probability of internal control incidents
Positive external qualification and certification reports
Number of control improvement initiatives
Absence of regulatory or legal non-compliance events
Decreased number of security incidents and quality defects

Management clearly defines what components of the processes need to be controlled
Internal control, compliance and internal audit responsibilities are clearly understood
Competence and authority of the internal control compliance function exist, addressing delegation as appropriate
A properly defined IT control process framework is in place
A clear process is used for timely reporting of internal control deficiencies
Internal control monitoring data is accurate, complete and timely
There is management commitment to act on internal control deficiencies
There is alignment with risk assessment and security processes
A process is in place to support knowledge sharing on internal control incidents and solutions