Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Tojasej > 7. Operations: Monitoring and Auditing Program Performance > Flashcards

7. Operations: Monitoring and Auditing Program Performance Flashcards

1
Q

What should metrics reflect?

A

Currency and value to the organization

*Must add value by by accurately reflecting the state of business objectives and goals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What should currency and value metrics be like?

A
  1. Simple
  2. Quantifiable
  3. Easy to use
  4. Correlated to
    - Business performance
    - Operational goals
    - Technical outcomes
    - Regulatory guidelines
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is good practice when it comes to measurement systems?

A
  1. Easy to understand
  2. Repeatable
  3. Reflective of relevant indicators to the organization
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a metric?

A

A unit of measurement that should be as objective as possible and provide data that helps to answer specific questions about the business operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the difference between an objective and a goal?

A

Objective - broad based

Goal - measurable, easy to understand, relevant and useful to the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In what ways can organizations implement privacy objectives?

A

Metrics that

  1. Normalize the privacy concepts - allow for meaningful privacy regime conversations
  2. Eliminate terminology and jargon - allow for decisions at an operational level
  3. Not based on a specific technology or application
  4. Advance the maturity of the privacy program and operations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What should metrics demonstrate?

A
  1. Compliance
  2. Program success
  3. Program maturity
  4. Resource utilization
  5. Return on investment
  6. Process improvement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What do metrics highlight?

A

Trends, issues, and gaps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What do the right metrics allow for?

A

The development of KPIs that assist the organization in setting and tracking multiple objectives and goals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are general industry guidelines for metrics?

A
  1. Identify the privacy goals critical to the organization (why and to whom)
  2. Develop the formal intent of the metric based on goals
  3. Apply practical measurement to qualify the output (success, failure, goal met etc.)
  4. Evaluate and categorize metric data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What should metrics reflect?

A
  1. Compliance
  2. Data-driven decision making
  3. Overall impact of the privacy program

*Practical privacy program management in creating and maintaining compliance factors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the role of the metric owner?

A

Evangelize the purpose and intent of the metric.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What should a metric owner know?

A
  1. What is critical about the metric

AND

  1. How it fits into the business objective
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the responsibility of the metric owner?

A

Monitoring process performance, variance, and undertaking visualizations

Preforming regular reviews to determine if the metric is still effective and provides value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is one of the easiest statistical methods for data reporting?

A

Trend analysis - spot patterns in the information as viewed over a period.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are examples of trending methods?

A
  1. Simple data patterns
  2. Fitting a trend
  3. Trends in random data
  4. Goodness of fit
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a time series analysis?

A

Shows trends in an upward or downward tendency

*E.g.: number of incidents over time, how many PIAs were completed, number of privacy training and awareness sessions

18
Q

What is a cyclical component?

A

Shows data over a period focused on regular functions

*E.g.: measuring the number of incident responses in the month after an organization rolls out new privacy training - analysis focuses on explaining any changes in the number of reported incidents as the stance from the training increases

19
Q

What is an irregular component?

A

Analysis that focuses on what is left over when the other components of the series (time and cyclical) have been accounted for

E.g.: Absence incidents over a long period

20
Q

What is return on investment (ROI)?

A

An indicator to measure financial gain or loss or a project or program in relation to its cost.

21
Q

What is an ROI analysis?

A

Provides the quantitative measurement of benefits and costs, strengths and weaknesses of the organization’s privacy controls

The data can be:
1. Fixed or variable
2. Represent the best attempt to form an economic risk assessment to determine the probability of a loss
3. Maximize the benefits of investments that do not generate revenue, rather prevent loss

22
Q

What are the considerations when developing a ROI assessment?

A
  1. ROI of the function must be related to the reason for implementing the function
  2. The value of the asset must be defined (E.g., the cost of producing or reproducing the information, repercussions if the information is not available, harm to reputation, loss of confidence
23
Q

What is the best approach to developing a privacy ROI?

A

Look at a risk that has been mitigated and how to track the risk in financial terms

24
Q

How is business resiliency measured?

A

Through metrics associated with:
1. Data privacy
2. Incident response
3. Compliance
4. System outages
5. Other factors defined through business objectives

25
Q

What are the benefits to a strong business resilience program?

A

Help the organization prepare for audits and demonstrate compliance with regulatory requirements

26
Q

What is a Privacy Maturity Model (PMM)?

A

A useful metric that focuses on a scale rather than an endpoint.

27
Q

What are the five privacy maturity levels?

A
  1. Ad hoc - informal procedures and processes applied inconsistently
  2. Repeatable - procedures and processes are not fully documented and do not cover all relevant aspect
  3. Defined - fully documented procedures and processes and cover all relevant aspects
  4. Managed - reviews are conducted to assess the effectiveness of the control in place
  5. Optimized - regular review and feedback are used to ensure continual improvement toward optimization of a given process
28
Q

What are the types of privacy monitoring?

A
  1. Compliance through audits - focuses on the collection, use, and retention of PI
  2. Regulation through monitoring changes in legislation and regulation requirements - focuses on updating policies accordingly
  3. Environment monitoring - focuses on vulnerabilities (E.g., physical concerns, programmatic concerns, insider threats, cybersecurity threat)
  4. Training data - focuses on ensuring that employees are aware of laws, regulations, and organization requirements for the handling of data
29
Q

What are the common approaches to compliance monitoring through audits?

A
  1. Self-monitoring
  2. Audit management
  3. Security/system management
  4. Risk management

*Compliance monitoring is essential for detecting and correcting violations, supporting enforcement actions, and evaluating progress.

30
Q

What are forms of monitoring?

A
  1. Scanning tools for network storage - used to identify risks to PI and monitor internal policy compliance
  2. Internal and external audits
  3. Breach management practices
  4. Compliant monitoring process
  5. Data retention and record management
  6. Privacy controls at the operational and program level
  7. Privacy protection across HR processes
  8. Supplier/third party monitoring
31
Q

What is an audit?

A

An ongoing process of evaluating the effectiveness of controls throughout the organization’s operations, systems, and processes.

32
Q

What can audits identify?

A

Risks posed by vulnerabilities and weaknesses and provide opportunities to strengthen the organization.

33
Q

What is the purpose of a privacy audit?

A

Determine the degree to which technology, processes and people comply with privacy policies and practices.

*Based on the purpose, audits may be conducted regularly, ad hoc, or on demand.

34
Q

What is the rationale for a privacy audit?

A

Provide evidence regarding whether privacy operations are doing what they were designed to do and whether privacy controls are correctly managed.

35
Q

What are the phases of a privacy audit?

A
  1. Plan
  2. Prepare
  3. Audit
  4. Report
  5. Follow-up
36
Q

What are the elements of an audit plan?

A
  1. Conducting a risk assessment
  2. Setting a schedule
  3. Selecting the auditor
  4. Preparing a pre-audit questionnaire
  5. Hosting an introductory meeting
  6. Completing a checklist
37
Q

What are the elements of an audit preparation?

A
  1. Confirm the schedule
  2. Prepare additional checklists
  3. Sample criteria
  4. Finalize the audit plan
38
Q

What are the elements of the audit?

A
  1. Meeting with stakeholders and business process owners
  2. Execute the functional goals of the audit
39
Q

What are the elements of an audit report?

A
  1. Record and report noncompliance (categorizing instances as major or minor)
  2. Draft a formal audit report
  3. Host a case-out meeting
  4. Distribute copies of the audit report

*Audit report is a formal record of what was audited and when, insight into areas that comply (or do not), details to support the findings, and suggested corrective action and work estimates.

*Instances of non-compliance are documented to include facts, evidence, best practices, and standards that help assess the situation

*Findings should be communicated to stakeholders along with risk, remediation plans, and associated cots

40
Q

What are the elements of an audit follow-up?

A
  1. Confirmation of the scope of remediation activities, scheduling those activities, and addressing any requirements around methodology
41
Q

What are the different types of audits?

A
  1. First- party (internal) - reflect constant, standardized, and valid privacy management that aligns with to a particular standard, guideline, or policy
  2. Second-party (supplier)
  3. Third-party (independent) - identify weaknesses of internal controls, legitimize first-party audits, provide expert recommendations

Tojasej (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions