Entries by Jason Rohlf

Working It Out: Lessons from a Former Auditor, Part 3

This is my “sometimes the best lessons to learn are the hard ones” offering. I wish I could say that everything I am I owe to the tireless work ethic I’ve fostered since day one on the job. I cannot. In fact, there were stretches in the early part of my career where the best adjective I can muster up to describe them is wayward. The real value of this lesson for me is in another I’ve learned:
It’s never too late.

Focusing on What Matters: Lessons from a Former Auditor, Part 2

I am what you might call a late bloomer. It took a while, but I finally feel like I’m coming into my own with this whole “being a professional” thing. I share this because in my early days as an internal auditor I didn’t really grasp the concept of why we were doing what we did, let alone how we were helping drive a risk-focused culture in our organization.

Understanding the Essence of “Why”: Lessons from a Former Auditor, Part 1

To some, the constant barrage of “why” questions from their kids is irritating, but to me it was my very favorite thing about having those youngsters in my house. The concept of “why” is rooted in learning. When you ask this question, you are seeking to gain knowledge, perspective, understanding—you simply want to figure it out.

Tell Me a GRC Story!

In my role leading the Solutions team at Onspring, I have the distinct honor of being one of our company’s primary storytellers. When your primary responsibility is helping clients piece together the various, individual aspects of their GRC programs—risk assessment software, compliance and control, and other solutions—into a compelling narrative about the overall health of the organization, you quickly realize that this analogy is apt.

Rethinking the RCM

Much like fire and early man, the Excel-based RCM-to-Assurance Professional relationship has seemingly been in existence since the dawn of time (or at least the dawn of Excel). Thankfully there is a better way to manage this critical element of your assurance process. And you can do it without having to sacrifice what made the Excel-based approach so appealing in the first place—structured data, demonstration of key relationships, management of key attributes.

All Signs Point to Legal

From the perspective of the Legal professional, the demand on time and effort can be difficult to capture, organize and manage. Time is, as we all know, expensive. The Onspring Corporate Counsel solution allows Legal teams of all shapes and sizes to manage the requests, reviews and matters.

Gartner IRM vs. GRC: What’s in a Name?

IRM vs. GRC: What’s in a name? And what does this all mean? For many it means learning a new language and making old terms taboo. For others it means straddling both sides of the fence. And for others it doesn’t mean very much at all. Jason Rohlf explains.

SOX Status Check: Coordinating Compliance Efforts

Each of the primary groups impacted by SOX—Management, Public Accountants and Internal Auditors—has more clearly defined what role they play in the overall process, and this definition has been carefully and thoughtfully refined over time. And while we have reached a much more structured and stable point in the SOX lifecycle, it’s never a bad idea to revisit and refresh our understanding of why this structure works. A big reason why we find ourselves in this more predictable state is that all involved parties have a much better understanding of their specific role in the process.

Show Me: How to Build an Effective Control Testing Program

I believe you’d be surprised at the number of organizations that do not have a fully structured approach to evaluating the effectiveness of their system of controls. Whether their approach is not formally defined and communicated, inconsistently applied and/or inefficiently managed and monitored, they are at risk of not fully understanding whether their controls are meeting their stated objectives or worse, being completely caught off guard by a critical control failure that could lead to much more serious issues. To that end, we offer the following considerations as you evaluate the effectiveness of your control testing program.