CICA Top 10 Survey

1. Part 2 CICA Top 10 Survey

2. Technology Trends – CICA Top 10 Survey Information Management and Data Integrity Legislation, Regulation and Compliance New and Emerging Technologies Information Skills and Resources – In the Information Age IT Governance Outsourcing Public Trust Management and Operation of Technology Infrastructure Business Continuity and Pandemic Awareness Impact of the Economy on Information Technology

3. 1 - Information Management and Data Integrity The categorization and management of information as a resource with business value to the organization • Maintaining Data Integrity • Complete, accurate, authorized, relevant, timely, consistent • Encryption – A Pressing Need • Protecting against unauthorized access, theft or use of data • Information Overload • Amount of information – information overload, unfiltered information • Sources of information - email, Blackberry, cell phone, iPad, Playbook • Better Understanding of the Value of Information • Presentation, visualization, data analytics, greater insight Don’t need more information; we need better, more relevant information

4. Information Management and Data Integrity Analysis • Data Loss Prevention • Policies, procedures, techniques • Protect against unauthorized access to, and release of, information • Data Retrieval • Data categorization, availability and retrievability • Issues; redundancy, consistency, synchronization, maintenance Determining The Value of Information Who determines value How much should be spent for data security What are managements’ priorities

5. Information Management and Data Integrity Analysis Determining The Value of Information Data Protection Priorities

6. Information Management and Data Integrity Related Studies Information Analytics "increasing the use of information and analytics is one of the top three business priorities" Visualization “visualization (which was defined within the study as "refers to the innovative use of images and interactive technology to explore large, high-density datasets") was increasingly being used to identify insights into both structured and unstructured data for such areas as operational efficiencies, profitability, and strategic planning” Challenges “handling the sheer volume of the data” “handling regulatory pressures to provide improved insights into risk management” Source: Gartner Group; cited in Deloitte Tech Trends 2011

7. Information Management and Data Integrity Business Reaction Rethink the “more is better strategy” Increase filtering of data to provide appropriate and relevant information Improve security over data and information Recognize the value of information to the organization Data Integrity Risk Management Assess risks to data and information, including risks of incomplete, incorrect, unauthorized (internal Wikis, personal productivity tools), Implement a comprehensive and robust data protection program (security, DLP, integrity) Implement sustainability and compliance programs, including monitoring

8. 2 - Legislation, Regulation and Compliance Legislation, Regulation and Compliance

9. 2 - Legislation, Regulation and Compliance Establishing, maintaining and managing legislative compliance, such as privacy requirements. • Large Number of Acts, Regulations etc. that must be Monitored and Complied with • Frequency of Legislative and Regulatory Changes • Ensuring Compliance Through ad hoc Methods • Increasing Industry Compliance Requirements • There is a need to change how we: • monitor changes, • evaluate their impact, • design and approach to changing systems and procedures • ensure sustainable compliance

10. Legislation, Regulation and Compliance Related Studies Uncertainty "level of uncertainty within regulations and the possibility that they may have to comply with potentially conflicting regulations" Source: Ernst and Young –Top 10 Risks 2011 - Number 1 Business issue Privacy Compliance “Regulations, laws and enforcement": key issues cited include tougher penalties and increased global cooperation in ensuring protection of private data” “Additional breach notification requirements": countries including Canada, the EU, Japan and others as seeking to implementing (if not already implementing) mandatory breach notification laws” "Governance, risk and compliance (GRC) initiatives“ - "financial institutions alone were spending up to US$100 billion on mitigating risks in 2010” “… greater choice in GRC tools to manage risks associated with governance and compliance” Source: Ernst and Young – Privacy Trends 2011

11. Legislation, Regulation and Compliance Related Studies Cost of Compliance “(recognized the) cost of compliance to be a major concern” “The cost of compliance has rocketed as companies moved from writing policies and discharging responsibilities to testing and demonstrating operation effectiveness.” “68% of the interviewees reported more boardroom interest in risk and compliance 82% expected compliance costs to increase in the next few years, with the majority expecting increases in the 10% to 20% range. KPMG’s Global CIO Survey

12. Legislation, Regulation and Compliance Related Studies Cost of Non Compliance None? GLB?

13. Legislation, Regulation and Compliance Business Reaction Implement systems and procedures to track, assess and design compliance policies and procedures Insure sufficient recognition and priority of GRC at the C-suite and board Implement employee awareness and training programs, newsletters Design sustainable compliance into processing and reporting systems Regulatory Compliance Risk Management Continuing changes in legislative and regulatory compliance Increasing complexity and more stringent requirements Increased reporting requirements requiring more effective data gathering and reporting systems Rationalizing uncertainty and conflicting requirements