California ISO Audit Results for 2011 SSAE 16 & Looking Forward for 2012 December 15, 2011

Similar documents
C22: SAS 70 Practices and Developments Todd Bishop, PricewaterhouseCoopers

Transitioning from SAS 70 to SSAE 16

ISACA Cincinnati Chapter March Meeting

REPORT OF THE INDEPENDENT ACCOUNTANT

Understanding and Evaluating Service Organization Controls (SOC) Reports

Service Organization Control (SOC) Reports: What they are and what to do with them MARCH 21, 2017

IAB internet advertising revenue report 2017 first six-months results

Independent Accountant s Report

SAS 70 & SSAE 16: Changes & Impact on Credit Unions. Agenda

Studio Guggino and Newtonpartner S.r.l. a team of professionals at the service of your Company

CSF to Support SOC 2 Repor(ng

Making trust evident Reporting on controls at Service Organizations

Retirement of SAS 70 and a new generation of Service Organization Control (SOC) Reports

SOC Updates: Understanding SOC for Cybersecurity and SSAE 18. May 23, 2017

Auditing and assurance

SAS 70 SOC 1 SOC 2 SOC 3. Type 1 Type 2

Exploring Emerging Cyber Attest Requirements

Evaluating Cybersecurity Coverage A Maturity Model. Presented to: ISACA Charlotte Chapter Vision for IT Audit 2020 Symposium

ISACA Survey Results. 27 April Ms. Nancy M. Morris, Secretary Securities and Exchange Commission 100 F Street NE Washington, DC

SAS70 Type II Reports Use and Interpretation for SOX

SERVICE ORGANIZATION CONTROL (SOC) REPORTS: WHAT ARE THEY?

Weighing in on the Benefits of a SAS 70 Audit for Third Party Administrators

SOC Reporting / SSAE 18 Update July, 2017

WHICH SOC REPORT IS RIGHT FOR YOUR CLIENT?

Period from October 1, 2013 to September 30, 2014

SAS 70 Audit Concepts. and Benefits JAYACHANDRAN.B,CISA,CISM. August 2010

A SERVICE ORGANIZATION S GUIDE SOC 1, 2, & 3 REPORTS

Adopting SSAE 18 for SOC 1 reports

The Texas A&M University System. Internal Audit Department. Fiscal Year 2014 Audit Plan

Testers vs Writers: Pen tests Quality in Assurance Projects. 10 November Defcamp7

SOC for cybersecurity

( ' ' (6-6 (6/%& A ' (6 -& (6 - & & (& %& (6-6 (6 $&&&

Ethics and Professional Conduct for Colorado CPAs CR&R. Course #4000N Exam Packet

CRIMINAL NETWORK INTRUSION AND DATA THEFT: Today s Security Landscape and What to Do If You ve Been Compromised

SSAE 18 & new SOC approach to compliance. Moderator Name: Patricio Garcia Managing Partner ControlCase Attestation Services

Within our recommendations for editorial changes, additions are noted in bold underline and deletions in strike-through.

ISO 27001:2013 certification

Auditing IT General Controls

Presenter: Ian Musweu FCCA, FZICA, CRA. Head of Risk and Assurance Professional Insurance

AND ASSURANCE AN INTEGRATED APPROACH SIXTEENTH EDITION GLOBAL EDITION

SAS 70 revised. ISAE 3402 will focus on financial reporting control procedures. Compact_ IT Advisory 41. Introduction

International Auditing and Assurance Standards Board (IAASB) International Federation of Accountants 545 Fifth Avenue, 14 th Floor New York, NY 10017

Error! No text of specified style in document.

Enterprise resilience and the role of Standards

WECC Internal Controls Evaluation Process WECC Compliance Oversight Effective date: October 15, 2017

IT Attestation in the Cloud Era

SOC 3 for Security and Availability

Exam Questions IIA-CGAP

PCI DATA SECURITY STANDARDS VERSION 3.2. What's Next?

CASA External Peer Review Program Guidelines. Table of Contents

The HIPAA Security & Privacy Rule How Municipalities Can Prepare for Compliance

Evaluating SOC Reports and NEW Reporting Requirements

Mastering SOC-1 Attestation Reports Under SSAE 16: Auditing Service Organizations Controls in the Cloud

THE INTERNATIONAL INSTITUTE OF CERTIFIED FORENSIC ACCOUNTANTS, INC. USA. CERTIFIED IN FRAUD & FORENSIC ACCOUNTING (Cr.

Audit Considerations Relating to an Entity Using a Service Organization

IIA EXAM - IIA-CGAP. Certified Government Auditing Professional. Buy Full Product.

Independent Assurance Statement

THE CARTER CENTER, INC. Supporting Psychosocial Health and Resilience in Liberia Project from the International Development Association (World Bank)

Accountancy (ACCTCY) Accountancy (ACCTCY) 1

The SOC 2 Compliance Handbook:

ADVANCED AUDIT AND ASSURANCE

INTERNATIONAL STANDARD ON AUDITING 505 EXTERNAL CONFIRMATIONS CONTENTS

IT Audit Auditing IT General Controls

A sharper focus on internal controls

GDPR: A QUICK OVERVIEW

METERING SERVICE PROVIDER REGISTRATION PROCEDURE (PART1)

Lahore University of Management Sciences. ACCT 250 Auditing Spring Semester 2018

Credit Union Service Organization Compliance

SOC Lessons Learned and Reporting Changes

TRAINING SEMINAR COURSE OUTLINE October

The Texas A&M University System Internal Audit Department MONTHLY AUDIT REPORT

Figure 1: Summary Status of Actions Recommended in June 2016 Committee Report. Status of Actions Recommended # of Actions Recommended

Demonstrating data privacy for GDPR and beyond

Table of Contents. Preface xvii PART ONE: FOUNDATIONS OF MODERN INTERNAL AUDITING

SSC Transformation Initiative Fairness Monitoring Services

COUNTY AUDIT HILLSBOROUGH COUNTY, FLORIDA CONSULTANT COMPETITIVE NEGOTIATION ACT (CCNA) PROCUREMENT PROCESS AUDIT REPORT # 251

NE HIMSS Vendor Risk. October 9, 2015 MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS

PwC Medical Technology Innovation Scorecard. Update June 2010

Hong Kong Institute of Certified Public Accountants Practising Certificate ("PC") Business Assurance

Auditors Oversight Bodies and Auditing and Accounting Standards Setters in Japan. May 2005 Financial Services Agency, Japan

International Standard on Auditing (UK) 505

Minimum Requirements For The Operation of Management System Certification Bodies

Does a SAS 70 Audit Leave you at Risk of a Security Exposure or Failure to Comply with FISMA?

Achieving third-party reporting proficiency with SOC 2+

Cyber Risk and Networked Medical Devices

Position Description IT Auditor

To the management of Entrust Datacard Limited (formerly known as Entrust Limited, hereinafter Entrust ) and Trend Micro, Inc.

SOC Reports The 2017 Update: What s new, What s not, and What you should be doing with the SOC Reports you receive! Presented by Jeff Pershing

WEB ANALYTICS. An Overview

Standing Together for Financial Industry Resilience Quantum Dawn 3 After-Action Report. November 19, 2015

DESCRIPTION OF AUDITING STANDARDS

Headline Verdana Bold

Key Customer Issues to Consider Before Entering into a Cloud Services Arrangement

RSB Standard for participating operators

HIPAA Privacy, Security and Breach Notification

PREPARING FOR SOC CHANGES. AN ARMANINO WHITE PAPER By Liam Collins, Partner-In-Charge, SOC Audit Practice

Physical Security Reliability Standard Implementation

LIST OF SUBSTANTIVE CHANGES AND ADDITIONS. PPC's Guide to Audits of Local Governments. Thirty first Edition (February 2016)


Independent Accountant s Report

Transcription:

www.pwc.com California ISO Audit Results for 2011 SSAE 16 & Looking Forward for 2012 December 15, 2011

Agenda SSAE 16 Background Results of Audit Scope of Audit Looking Forward Closing Thoughts Slide 1

SSAE 16 Background Purpose of Report - To report on the ISO s internal controls relating primarily to its market operations and settlements activities Expected use of report - Assurance to market participants who rely on the ISO s controls related to the ISO s market settlements - The report is required by some market participants and their auditors to comply with Sarbanes-Oxley (404 Attest) Report period - November 1, 2010 October 31, 2011 This is the first report issued by the ISO under the new standard, Statement on Standards for Attestation Engagements No. 16 (SSAE 16) Slide 2

SSAE 16 vs. SAS 70 Similarities Differences Scope of controls focused on controls that would be relevant to a market participant s internal control over financial reporting Management of the ISO provided a written assertion on the fair presentation, suitability of design, and operating effectiveness (based on ISO assessment) Description of controls under SAS 70 were the basis for the description under SSAE 16 Opinion changed was modified but generally covered the same scope Restricted use of report (ISO management, market participants, and their auditors) Suitability of design of controls covered the entire period Slide 3

Results of Audit opinion and report were issued on December 7, 2011 The opinion is unqualified - Controls were suitably designed - Controls were operating effectively Two exceptions were identified during our testing - Disclosed in the results section of the report - Determined to not impact the achievement of the control objective, and therefore did not impact the opinion Slide 4

Scope of Audit Scope is similar to prior year market controls report issued in December 2010 Processes not included in the scope of report - Control room and operational judgments and decisions - Processes after the settlement statement preparation (such as invoicing and market clearing) - Other functions that are transparent to the market Testing of controls - Covers 12 main areas (the 12 control objectives) - Over 60 different control activities tested - Over 1600 transactions/items tested Slide 5

Scope of Audit ISO Bid to Bill Functions Conduct CRR Market Collect and Validate Bids DA Market Conduct Markets RT Market Collect Meter Data Post Market Processing Calculate Settlements Perform Invoicing & Cash Clearing Standing Data Maintenance IT Infrastructure Substantially in Scope Out of Scope Slide 6

Looking Forward The next audit period has already begun started on November 1, 2011 and ISO staff have begun planning for next year s internal controls audit - Continuous process improvement cycle - Debrief on 2011 and lessons learned for 2012 - No significant changes in control environment are anticipated Slide 7

Closing Thoughts Unqualified opinion is a significant accomplishment for the ISO Demonstrated a high level of ownership for the control environment and ownership of the controls report Benefits of the audit include: - Direct assurance to market participants/ auditors - Internal assurance to ISO management related to market controls - Process improvement feedback from - Governance coverage by ISO Board Questions? Slide 8

Thank you 2011. All rights reserved. In this document, "" refers to PricewaterhouseCoopers LLP, a Delaware limited liability partnership, which is a member firm of PricewaterhouseCoopers International Limited, each member firm of which is a separate legal entity. This document is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.