3 Things All Security Audits Must Contain for LA Investment Advisors - Craig Pollack FPA

Here are 3 crucial points that all security audits should contain:

1. Review of established security policies

Established security policies are your investment company’s foundations - the very lifeblood of your business’s security strategy. Upon an Auditors arrival, the first thing they’re going to look at is your policies.  You must be able to demonstrate that policies exist and are in use.  To do this, they need to be documented and show some sort of proof that they’re in use for them to verify your compliance.

Simply put, an investment advisory firm won’t successfully survive an audit if it hasn’t created, documented, and implemented its security protocols, disaster recovery plans, and addressed the implications of a security breach. How else do you expect to safeguard your business, and the details of your associates and clients from a prospective breach, cyber-attack or natural disaster?

2. Perform security vulnerability scans

Investment advisors come into contact with and store a great deal of sensitive information. There would be catastrophic consequences for you and your clients if such data were to become common knowledge or fall into the wrong hands. A security vulnerability scan will determine how secure your network is from internal and external threats, identify any weakness or potential for breaches, and help your company to up its game as far as security is concerned.

3. Review of contingency plans

An audit won’t just be looking for evidence that you’re doing things right, or are willing to make improvements, but also that you have strategies in place to protect your clients’ data and company’s information should the worse happen. Much as you’re likely to have a disaster recovery plan, an auditor will be looking for your coping mechanisms, and for the software that you have in place to protect your business’s interests.

Once the auditor has been and gone, make sure you review the audit report – what are you doing right, and what could be improved? An auditor’s report is not merely another piece of paperwork to be filed away and referred to just prior to your next audit, but a document that reflects how your business should be conducting itself. Audits are performed for the security of your company and its clients, so be sure to do something with the results.