Facilitated Compliance Management™
PB&SP's structured approach and application of our Facilitated Compliance Management™ methodology will provide a number of benefits to our client's IT organization. The benefits include:
PB&SP implements process management via an process development and tracking system (PDTS application). Written in Microsoft Access and Visual Basic, Faciliated Compliance Managemement™ (FMC™) data structure easily scales to an Oracle or SQL backend and can be customized and modified to run on a corporate intranet. Our internal use includes complex security and intranet features. Each client implementation scales to the environment and client culture.
The following list is a subset of some of the main forms. 20+ management reports and a document management function make this tool a perfect response to Sarbanes-Oxley's mandate of demonstrated and documented process and adhere's to the CobiT®.Control objective "Monitor the Process". More specifically, control over the IT process of monitoring the processes satisfies the business requirement to ensure the achievement of the performance objectives set for the IT processes, is enabled by the definition of relevant performance indicators, the systematic and timely reporting of performance and prompt acting upon deviations, while taking into consideration
FCM™ process documentation is integrated with real time Visio workflow diagrams:
We call this Visio On Steroids
Process information is captured in a SQL backend allowing for real time intranet content and instant visibility throughout the organization as determined by your own security and information access strategy.
Facilitated Compliance Management™(FCM) is a prototyping tool used to develop customized robust IT Regulatory compliant operations management processes. FCM Software supports achieving at least level 3 maturity across most IT Regulatory Control Domains including those defined in CobiT 3.0/4.0: Conquer the Audit Universe!
|
Assessment Portal Regardless of audit framework, the domains, processes, details and audit guidelines for your enterprise. Allowing for each corporation's customized "Audit Universe", the Control Self Assessment Portal includes Industry standard control objectives, such as those in CobiT®, COSO®, various NIST/FIPS, PCI/VISA (CISPV2.3), ISO/IEC 17799:2000 - BS7799:2 and FISCAM, with associated implementation, test and audit guidelines, performance and goal Indicators, success factors, and more. Built for reporting ease and distributed ownership, all standards are categorized at high, mid and detail level description. Extensive mapping allows rapid recognition in overlap and ease in aligning disparate groups using hypbrid control models. Audit Universe customization is critical to a successful Governance Risk Compliance Architecture. We've known this for many years, so the mapping of audit and process frameworks is a natural evolution of our product.
CobiT®, COSO, ITIL, FISCAM, ISO/IEC 17799:2000, BS7799:2, PCI/VISA, NIST 53a Controls Management shows each control objective with its associated Performance and Goal Indicators, recommendation for implementation, test and if available, diagrams and domain level description.
|
| Audit Planning and Audit Plan Forms captures work plans, assigned tasks by business unit and per auditor and general long term/short terms goals and issues specific to the internal audit team. Allowing for general tracking of projects that introduce a broad range of process and change, audit planning assigns internal documents and behaviors to specific audit milestones and control assessment elements. Audit plan and planning forns gather current and future state Governance Risk Compliance architecture, training and testing documentation, and control testing plans. This form might be used to gather information on a project that is generating multiple audits across multiple geographic reagions. |
Process Management maps process to Control Domains and Objectives, and implements all stages and versions of a process implementation. The parent and subcomponent procedures associated to that process are both housed and developed from within this form. This component of the database is also used to create the word document that is posted to an internal Process library. Processes can also spawn work instructions, the real life steps to implementing specific procedures as required by the approved process.
|
Work Instruction Management houses all the stages and elements of work instructions or high level training steps associated with performing a process. In response to the requirements of Sarbanes-Oxley, clients are advised to create detailed work instructions for the maintenance and implementation of any financial controls. The work instruction form generates step by step word formatted training documentation.
|
Process Object Management is the container for records that represent objects such as business processes, forms, work instructions, job descriptions, modules, and tables. Object management provides an overall Process catalogue and allows the organization to assign Meta tags, inputs, and outputs to any activity. It is a way to identify and classify business and technology activity. Once an object exists, it is assigned to a profile record that is tracked. Processes are dynamic, so tracking, modifying and managing process is the main objective of the PDTS.
|
Risk Management Watch List contains high level risk areas associated with process projects. This form tracks owners and policy associated with Risk Management. It is a springboard and catalogue of risks that require attention by the Risk Managing Team. Adheres to the steps:
|
RunBooks are for recording all the emergency maintenance and operational procedures per system for an entire enterprise. This form supports business continuity and disaster recovery requirements. The reporting on RunBooks provides feedback towards reaching compliance in the following areas.
|
Controlled Servers Form records server, router and critical device information as it pertains to its continuous support, security, backup and management. The controlled server is the first step in introducing any element to the network and insures a record that can be built into a full RunBook.
|
Tools and Tool Type Form lists all applications, databases, element management systems, and their function. The tool table is part of the process where each executable is evaluated in terms of its functions and relative importance to financial and security controls. Tools are also rated for their importance to business productivity. The tools table is used to populate numerous dropdown fields in the FCM database.
|
Information Technology Service Management (ITSM) and Change Request Form allows any type of request to be tracked from entrance to delivery throughout all of IT, tracking from request to assignment as “service”, “maintenance”, “change”, “feasibility and ROI”, “project” or “network engineering release”, including all handoffs between.
Information Technology Service Management and Change Requests are not readily typed. Person's receiving a request for "change" will review the event type, and where appropriate, redirect the request to other processes or applications.
More information found in the Toolbox under Facilitated Compliance Management Continue to: Implementation |
©2006
