Discussion: The Influence of IA on Information
Security Effectiveness: Perceptions of Internal
Auditors
Urton Anderson, CCEP
Director of the Von Allmen School of Accountancy and Professor
The University of Kentucky
Agenda
Contribution – Putting the Paper in a Larger
Context
 IA and its relationship to other assurance
providers
 3 Lines of Defense Model
 Reliance on assurance providers
Some specific issues for discussion
 Should incidents go down?
 What is a finding?
 What is the “quality of relationship”?
IA and its relationship to other assurance providers
Who provides assurance in
organizations?
Organization as a Web of Assurance
Assurance Network
3 Lines of Defense
Reliance on assurance providers
COMBINED ASSURANCE
King III
Principle 3.5
The audit committee should ensure
that a combined assurance model is
applied to provide a coordinated
approach to all assurance activities.
8
2/22/2012
Regulatory
Oversight
4th Line
Results
Asset Safeguarding
Business Continuity
Crisis Management
Competitive Environment
Economic Environment
Hedging/Liquidity Management
Financial Reporting
Finance Processing
International Operations
Information Technology
Labor Relations/Staff
Legal
Operations
Regulator & Stakeholders
Revenue & Reputation
Environment
Suppliers & Key Relationships
Provider Assessment
Overall Provision
Low
Medium
High
Assurance
Assurance
Assurance
Opportunity
to Remove /
Refocus Effort
Assurance
Maintain
Gap
Current Status
Remove Duplicate
Assurance Activity
Review Other
Assurance Providers
Obtain Independent
Assurance
Assurance Provision
Corrective Action
Regulators
Investigations Proactive Safety
Monitoring
Quality Audit \
Compliance
Internal Audit
External Audit
IT Steering Group
Independent
3rd Line
SOX
Network
Development Forum
Environmental
Management Group
Safety Review Board
Performance Review
Meeting
Compliance
Risk Management
Processes
Communications
Assurance Provider
Planning
Functional Oversight
2nd Line
Commercial
Legal
Procurement
IT
Operations
Treasury
Human Resources
Management
1st Line
Finance
Performance Provider
Risk Assurance Map – Starting Template
Assurance Map (PWC)
Specific Issues
What is a finding?
Should incidents go down?
What is the “quality of relationship”?
Relational Coordination Theory
 Jody Hoffer Gittell - Brandeis
University
Relational Coordination Theory
 “New Directions for Relational Coordination
Theory,” in The Oxford Handbook of Positive
Organizational Scholarship, 2011
 The Southwest Airlines Way: Using the
Power of Relationships to Achieve High
Performance (McGraw-Hill, 2003)
 High Performance Healthcare: Using the
Power of Relationships to Achieve Quality,
Efficiency and Resilience (McGraw-Hill, 2009)
Urton Anderson
Von Allmen School of Accountancy
The University of Kentucky
(859)218-1788
urton.anderson@uky.edu