First Reference company logo

Inside Internal Controls

News and discussion on implementing risk management

machine cogs image

IT, Privacy and Security

Limitation periods and emails: Can an email signature extend a limitation period?

Potential debtors and defendants should proceed cautiously when exchanging emails with potential creditors and claimants knowing that such emails may extend potential limitation periods.

 

, , , ,

Is the COSO ERM update a success or failure?

Recently, COSO published an update to their 2004 ERM Framework. The product, retitled Enterprise Risk Management: Integrating with Strategy and Performance, is available from the AICPA or IIA.

 

, , , , ,

Expectation of privacy and electronic messaging: The Supreme Court of Canada to dot the “i’s”

It is best to remain abreast of developments in this matter, in order to clearly identify and be up-to-date on any guidelines concerning the disclosure of the content of messages between individuals in a judicial context.

 

, , , , , , ,

The root compliance problem: Shadow process

Sometimes I revisit my compliance roots in the world of Sarbanes-Oxley – a place much more concerned with financial reporting than corporate ethics and culture, I know. Yet lessons from one group that can help the other still abound.

 

, , , , , ,

A conversation about risk with a CEO

Leaving the word “risk” out of a risk discussion with an executive can prove to be a positive way forward when asking what can go right for a project rather than what might go wrong.

 

, , , ,

What HR needs to know about investigating an employee’s digital activity

You’ve been asked to review the digital activity of an employee. Your company has some concerns, and wants you to investigate. With the amount of enterprise-level technology and controls that most companies now have, shouldn’t that be fairly straightforward?

 

, , , ,

Major changes to Canada’s export and technology transfer controls coming into force shortly

The Government of Canada has announced that a new version of the Guide to Canada’s Export Controls (the “Guide”) will come into effect on August 11, 2017. The Guide lists the goods and technology subject to export and technology transfer controls.

 

, , , , , , , ,

Privacy Commissioner’s report on public perception of companies’ privacy practices holds lessons for business

The Office of the Privacy Commissioner of Canada (“OPC”) recently released a preliminary report outlining the results of a series of focus groups conducted with Canadians about privacy and the protection of personal information.

 

, , , ,

Protecting trade secrets when employees depart

Several recent court cases in the United States focus on the misappropriation of trade secrets by employees departing technology companies. These high profile American cases are a reminder that Canadian companies face the same issues.

 

, ,

Government of Canada publishes proposed Breach of Security Safeguards Regulations

On September 2, 2017, the Government of Canada published proposed Breach of Security Safeguards Regulations. The proposed regulations relate to the provisions in Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), which are not yet in force.

 

, , ,

Six principles for effective risk management

In World-Class Risk Management, I review the eleven principles in the ISO 31000:2009 global risk management standard and condense them to just six.

 

, , , , , , ,

Survival of the fittest: How can technology help small businesses thrive?

Canada’s failure rate for small and medium sized businesses is staggeringly high. Around one half of small and medium sized businesses survive past five years, while 15% don’t last a year. Today’s smaller businesses face a daunting task. The complexities of today’s market have created new risks, and myriad laws and regulations that can overwhelm just about any sized business.

 

, , ,

Update from the Canadian Securities Administrators on its Regulatory Sandbox for Fintechs

The week of June 26, the Canadian Securities Administrators (CSA) published some additional information on its CSA Regulatory Sandbox. The CSA Regulatory Sandbox, which was first launched on February 23, 2017, is an initiative of the CSA, designed to support Fintech businesses seeking to offer innovative products, services and applications in Canada.

 

, ,

Processes to support information technology effectiveness reviews

This blog post reminds organizations that they should take the time to conduct information technology effectiveness reviews, to evaluate and improve the IT department’s role in achieving the organization’s goals.

 

, , , , , , , ,

NIST’s recommended password policy evolves

As imperfect a means of authentication as they are, “memorized secrets” like passwords, pass phrases and PINs are common, and indeed are the primary means of authentication for most computer systems. In June, the National Institute of Standards and Technology issued a new publication on digital identity management that, in part, recommends changes to password policy that has become standard in many organizations—policy requiring passwords with special characters.

 

, , , , , , , ,

Previous Posts Next posts