Is Your Technology Ready for an Audit?

It is also important to stay up to date with your technology reviews and evaluation. As an example, consider sending an annual letter to the providers that store or access your confidential client data confirming that they have not had any data breaches or security issues. Of course, these providers should tell your firm at the time of any data or security breach, so their response should not be new information, but documenting your review is the important step.

With new state rules on business continuity going into effect soon, you should prepare to have processes and procedures in place to ensure that critical business functions can continue during and after a disaster or other significant business interruption. When was the last time your firm conducted a business resumption drill? Hopefully, you are doing them at least once per year. After conducting a drill, do you document the results of the exercise? For example, if you removed your primary Internet connection and successfully re-established connectivity using your back-up Internet service, you should keep a record of when you did it and any issues that arose. Then, while using your back-up connection, you should conduct several business processes (e.g., trading, money movement, opening an account). Keep in mind, it doesn't take a significant amount of documentation to demonstrate that your firm conducted an adequate business resumption drill.

Your firm's technology infrastructure and data security is often on the evaluation list during an audit. Many firms rely on their current IT provider to ensure they are compliant in this area. This makes sense, but as your firm grows, you might consider hiring another IT provider to audit your network. Essentially, you are getting a second opinion that everything is in good order and there are not any holes in your network.

Review Today Your Employees' Access Credentials

Who at your firm has access to your systems and technology products? Hopefully it is not one size fits all, where every employee has the same level of access. Some employees might need administrator access on their computer, but others may not. Some employees might need the ability to place trades, while others may require only access to view account information. Often an unnecessary risk at a firm is when an employee has access credentials that are way beyond their needs or capabilities. Take the time to create specific access credentials for each employee or group area, and then document the information.