Manual Review A member of the Data Inventory Quality Assurance team manually reviews the selected Data Inventory(s) with the business process owner(s) for accuracy. The business process owner is required to facilitate the audit by demonstrating the steps taken. To begin the audit, the member of the Data Inventory Quality Assurance team should thoroughly review the steps the business process owner took to populate the Data Inventory. Secondly, the team member should confirm the System classification assignment. If the business process owner(s) have successfully completed the Data Inventory, the audit can be concluded. If the business process owner(s) have not correctly completed the Data Inventory, the Data Inventory Quality Assurance team should assist the business process owner(s) in completing the Data Inventory correctly. Automated Review In this method, the Data Inventory Quality Assurance team will utilize a data discovery tool to determine the data sets within a system. The team member will take the following steps: Examine the results of the data discovery tool Identify the users who have handled sensitive data Tie those users to the respective business process Include the business process in the audit sample Determine if the corresponding Data Inventory includes the sensitive data discovered The Data Inventory Quality Assurance team member (and/or appointed delegate) is expected to fully understand the results of the data discovery tool before identifying the users of sensitive data. The team member then compares the data discovery tool results with the data sets within the corresponding Data Inventory to determine if the business process owner has accurately populated the Data Inventory. If the business process owner(s) have successfully completed the Data Inventory, the audit can be concluded. If the business process owner(s) have not correctly completed the Data Inventory, the Data Inventory Quality Assurance team should assist the business process owner(s) in completing the Data Inventory correctly. Monitoring Plan On an annual the Data Champion should monitor the progress made on the Data Inventory Analysis Report’s Steps for Gap Remediation”. The Data Champion is responsible for updating “Next the Data Inventory Analysis Report based on the changes to the Agency’s Data Inventories. Appendix Roles and Responsibilities The table below offers an overview of each role required to execute the Data Inventory Auditing and Monitoring Plan. Role Auditing and Monitoring Responsibility Agency Director Review submitted Data Inventory Analysis Reports and file them for records purposes
Manual Review A member of the Data Inventory Quality Assurance team manually reviews the selected Data Inventory(s) with the business process owner(s) for accuracy. The business process owner is required to facilitate the audit by demonstrating the steps taken. To begin the audit, the member of the Data Inventory Quality Assurance team should thoroughly review the steps the business process owner took to populate the Data Inventory. Secondly, the team member should confirm the System classification assignment. If the business process owner(s) have successfully completed the Data Inventory, the audit can be concluded. If the business process owner(s) have not correctly completed the Data Inventory, the Data Inventory Quality Assurance team should assist the business process owner(s) in completing the Data Inventory correctly. Automated Review In this method, the Data Inventory Quality Assurance team will utilize a data discovery tool to determine the data sets within a system. The team member will take the following steps: Examine the results of the data discovery tool Identify the users who have handled sensitive data Tie those users to the respective business process Include the business process in the audit sample Determine if the corresponding Data Inventory includes the sensitive data discovered The Data Inventory Quality Assurance team member (and/or appointed delegate) is expected to fully understand the results of the data discovery tool before identifying the users of sensitive data. The team member then compares the data discovery tool results with the data sets within the corresponding Data Inventory to determine if the business process owner has accurately populated the Data Inventory. If the business process owner(s) have successfully completed the Data Inventory, the audit can be concluded. If the business process owner(s) have not correctly completed the Data Inventory, the Data Inventory Quality Assurance team should assist the business process owner(s) in completing the Data Inventory correctly. Monitoring Plan On an annual the Data Champion should monitor the progress made on the Data Inventory Analysis Report’s “Next Steps for Gap Remediation”. The Data Champion is responsible for updating the Data Inventory Analysis Report based on the changes to the Agency’s Data Inventories. Appendix Roles and Responsibilities The table below offers an overview of each role required to execute the Data Inventory Auditing and Monitoring Plan. Role Auditing and Monitoring Responsibility Agency Director Review submitted Data Inventory Analysis Reports and file them for records purposes
Instructions_Template_Auditing_and_Monitoring_Plan_1.5.docx