The objective of this report is to provide relevant information on the current state of privacy and data protection worldwide. General considerations and approaches to managing and evaluating privacy risk will allow business managers and auditors to identify and manage those risks.
Kim Hargraves, CPA, CISA, is the IT Audit Senior Manager at
Microsoft Corporation. She manages the business/IT integration team
for Microsoft Corporation. This team is engaged in audit support
initiatives to assess systems risk and perform audits across all of
Microsoft’s business units, and provide integrated systems audit
support services for operations audits,systems development, and
process reengineering. In addition, she is responsible for internal
audit’s privacy assurance initiative and works closely with
Microsoft’s Corporate Privacy Group in strategic areas in order to
enhance the program and the company’s ability to ensure compliance
with related laws, regulations, corporate directives, and best
practices. Ms. Hargraves specializes in security and privacy,
application development audits, and SAP audit and controls. Her past
experiences include SAP security consulting and financial auditing for
PricewaterhouseCoopers,and financial analysis for Specialty Brands.
Susan Lione, CIA, CCSA, CGAP, is Assistant Vice President of Research
at The Institute of Internal Auditors (IIA) in Altamonte Springs,
Florida. She has worked at The IIA since 1993. Prior to joining The
IIA, Ms. Lione was Senior Auditor at Martin Marietta (now known as
Lockheed Martin), as well as auditor for the Naval Audit Service in
Jacksonville, Washington,DC, and Orlando. She has over 10 years of
internal auditing experience and specializes in operational,
compliance, and financial audits. Ms. Lione recently retired from the
Air Force,having completed over 20 years of active duty and reserve
service. Ms. Lione received her B.S. degree in accounting from Old
Dominion University, and her M.B.A. from Florida Institute of
Technology.
Kerry Shackleford, CPA, CISA, CCP, is the General Manager and sole
employee of KLS Consulting LLC, a Colorado limited liability company
formed in 2002. He has 17+ years of experience consulting with clients
on matters of business and technology risk assessment and
management. Prior to starting this new venture, Mr. Shackleford led
Arthur Andersen’s worldwide privacy and data protection
practice. Mr. Shackleford has a working knowledge of fair information
practices generally and the requirements of specific U.S. privacy
regulations such as GLBA, HIPAA, and the US/EU Safe Harbor
program. Mr. Shackleford holds a bachelor of arts degree in computer
science and a concentration in accounting from Baylor University in
Waco, Texas.
Peter Tilton, CPA, CISA, is the Director of IT Audit Services at
Microsoft Corporation. He leads several Internal Audit Services
initiatives to assess IT risk and strategy across the
company,including worldwide security policies and practices, IT
application and infrastructure security, electronic commerce, and
integrated systems audit support services for operations audits,
systems development, and process reengineering. Mr. Tilton’s group
also performs a key role within Microsoft Internal Audit Services to
help envision and develop technology solutions to manage the audit
process more effectively. He is a member of The IIA’s Advanced
Technology Committee, and recently led the development of Systems
Assurance and Control (SAC), The IIA’s framework and guidance to help
understand, assess, monitor, and mitigate technology risks. Before
joining Microsoft in 1996, Mr. Tilton worked for Price Waterhouse in
Denver.
