How can organizations ease audit overload?

A research from Vanson Bourne examines how financial services are faring with the ever-increasing challenge of audit overload.

The study, which surveyed 200 U.S. IT security professionals in the financial services industry, revealed that 97 percent financial institutions experience challenges when working on audits. While these challenges clearly impact the overall audit process, they also have implications for the IT security team members themselves.

78 percent of surveyed IT security professionals in 2020 reported that they personally dread when their organization is audited. This figure has risen to 95 percent in 2021.

The state of the financial services’ audit process

• Financial organizations spend an average of 71 working days each quarter responding to audit evidence requests, have an average of 13 different IT security compliance and privacy regulations with which they must comply, and have an average of 54 dedicated people who work on IT security compliance and/or privacy regulations.
• In 2021, 45 percent of organizations experienced employee sickness due to stress-related illness and 36 percent reported employee dissatisfaction, as compared to 34 percent and 19 percent, respectively, in 2020.
• While 64 percent of financial organizations use commercial governance, risk and compliance (GRC) solutions; IT GRC solutions; or IT risk management products, 47 percent use a custom solution and 37 percent are still using spreadsheets to manage their compliance processes.
• 96 percent of IT security professionals believe that the tools their organization uses to collect security data could be improved in order to fully meet their needs – data aggregation and interpretation is something that 76 percent find particularly difficult.

“With the audit process continually increasing in complexity, the importance of tools that ease the process of aggregating and interpreting security data is more critical than ever,” said Rick Tracy, CSO and senior product manager at Telos.

“With a new year quickly approaching, it’s time for organizations to rethink the current toolbox being used in their audit process by embracing automation, streamlining workflows and employing capabilities that bring the entire security compliance operation into perspective.”

With the average number of IT assets and cloud resources being monitored by financial organizations at any given time reaching just over two million, and with institutions running an average of 209 security control tests each month – of which only an average of 53 percent are automated – it is time to rethink the process.

“For organizations to streamline workflows and get ahead when it comes to audits, they need to implement processes that will accelerate audit activities and pull together massive amounts of compliance data in a concise and meaningful way,” said Tracy. “This will relieve the pressure on staff, free up necessary resources and ultimately make audits efficient and more accurate.”