TALLAHASSEE, Fla.—Are most credit unions ready for their IT audit this year, and just as important, prepared to deal with the findings from the review?
One IT CUSO contends that with IT staff already stretched thin due to growing security and compliance demands, that the IT audit is becoming a difficult event for many to manage.
“As the regulatory and compliance environment gets even more intense, and your IT staff is struggling to keep up with just the day-to-day challenges of maintaining existing systems and end-user support, audits become a burden,” said Mark Holt, VP of service at United Solutions.
Audit Firm Findings
Audit firms test a credit union’s IT infrastructure and security to the fullest extent possible, and from that the credit union receives a detailed list of findings and recommendations.
“All of which will need to be addressed by both IT staff and the CU’s management team,” said Holt. “These reports can be hundreds of pages long and contain up to 120 or more findings that must be addressed. That’s when the fun really begins.”
Holt said there’s normally a fairly short timeframe between the audit firm’s report and the CU’s response.
“This can be a nightmare for both IT and CU management,” he said. “No matter how well run or technologically up-to-date a credit union is, there will always be something the audit teams will find and how the credit union responds is critical,” said Holt.
Mark Holt, United Solutions
If the first response isn’t detailed and sufficiently comprehensive, with specific solutions that address audit findings and date-certain implementation plans, state and federal regulators may decide more remediation is necessary, noted Holt.
“This kind of situation harkens back to the old project management truism: ‘If you don’t have time to do it right the first time, how are you going to have time to go back and do it all over again?’” said Holt.
For credit unions who’ve contracted with a technology services provider for managed IT services, however, it’s a “different story,” said Holt, whose company is a technology services CUSO.
Familiar With The Process
“One of the byproducts of having a technology CUSO managing your infrastructure is that they’ll be the ones responding to most of the findings. In fact, audit firms will typically send their teams to the CUSO to conduct the audit instead of the credit union if they use a managed IT provider. The credit union is still responsible for the overall audit response, but most of the work in responding to findings and making recommendations will already have been done by the technology CUSO.”
Holt noted that technology CUSOs respond to audits on behalf of their customers on a regular basis, versus CUs that only address the matter once a year.
“The CUSOs can provide a detailed, professional audit response quickly,” said Holt. “While this may be something a technology CUSO will charge their managed IT customers an additional fee to provide, it’s a valuable service that can take the burden off of an already busy credit union IT staff.”