Introduction - Governance, Risk, and Compliance Topic for Oracle Applications - page 9

• Ensuring the timely completion of internal auditing engagements
• Ensuring that reports on internal auditing engagements are provided
to the audit committee with minimum delay
• Providing an annual holistic opinion on the effectiveness and adequacy
of risk management, control, and governance processes
Chief Financial Officer
As well as being one of the signing officers, the CFO obviously heads the
departments that are involved in processing of transactions that most directly
affect the subledgers and general ledger, the preparation of financial statements,
and financial planning and analysis.
Chief Information Officer
In addition to Sarbanes-Oxley (SOX), CIOs and CSOs must understand and achieve
compliance with the Health Insurance Portability and Accountability Act ( HIPAA )
the Payment Card Industry Data Security Standard ( PCI DSS ) for organizations
processing credit card transactions, and the Federal Information Security
Management Act ( FISMA ) for federal agencies as well as many other global,
national, and industry-wide regulations and mandates.
IT governance includes writing IT policies that define who within an organization
is responsible for key decisions with regards to IT adoption and usage, who is
held accountable for such decisions, and how results are monitored and measured.
Implementing IT governance strategies includes assigning committees to steer
technology adoption, architectural reviews, and project analysis. Governance is
about processes, which should support consistent and transparent methods for
managing your information technology acquisitions and usage.
The CIO is also responsible for IT risk management. Risk management requires
adapting to constantly changing business requirements and monitoring what
technologies are deployed within the organization Risk management encompasses
surviving a constantly changing threat landscape by tightening and optimizing an
organization's information security, both perimeter and internal, while improving
business agility and efficiency.
The CIO is also responsible for IT compliance approaches, governance by designing,
assessing, and implementing controls. These controls must map back to the various
industry requirements and best practices that ultimately determine success or failure
during an IT audit.