Take your technology risk and compliance strategies to the next level with powerful insights on independent control validation, third-party risk management, and the evolving audit ecosystem. It’s time to move past rubber-stamp compliance, navigate the alphabet soup of IT frameworks, and understand how AI is transforming sampling into full-population testing. Who better to guide you through it than retired EY partner, Americas Technology Risk practice leader, and senior cybersecurity advisor Bernie Wedge?
You will learn how to evaluate auditor credibility through peer reviews, avoid the marketing trap of "instant" SOC 2 tools, and streamline multi-framework testing into a single efficient audit cycle. Get motivated to ask tougher questions of your third-party providers, align controls across the business, and build a trust center that provides real transparency!
Takeaways:
- The Reality of SOC 2: While lower-cost auditors and automated GRC tools have created instances of "security theater," SOC 2 remains a robust, vital assurance mechanism when executed with proper governance and independent testing.
- Auditing the Auditors: Organizations must exercise due diligence by requesting peer review reports from their auditing firms to verify credentials and ensure proper quality control standards.
- Navigating Framework Proliferation: Rather than siloing SOC 2, ISO, HITRUST, and PCI efforts, leaders should adopt a "test once, use many" approach to audit overlapping foundational controls simultaneously.
- Asking the Right TPRM Questions: Vendor risk management requires reading the actual details of a SOC 2 report, challenging sample sizes, testing depth, and even interviewing the signing audit partner, rather than just filing the document away.
- AI's Impact on the Future of Auditing: Generative AI tools allow auditors to move away from small sample sets and analyze entire populations of system logs and access requests in real time.
Quote of the Show:
"SOC 2 is not a security theater for those who put time and effort into doing reports correctly, but it is sort of what the company puts into it." - Bernie Wedge
Links:
- LinkedIn:https://www.linkedin.com/in/bernie-wedge-jr-59817583/
- Website: http://www.openhandatlanta.org
- arc360.com
- https://s2guild.org/
Ways to Tune In:
- Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0
- Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297
- Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47
- iHeart Radio: https://iheart.com/podcast/319629841/
- Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550