We are going to Incremental Compliance Test our way out of this consent order.
That will show them. Great way to use it 1,000 testers when it doesn’t even align with company’s framework.
It’s a sneaky way of saying “things are broken” without saying “things are broken”.
Get ready for the upcoming RCSA sh%!show
All depends on the IT&v group, won’t name the team I’m on but we have a lot of pretty talented people and have found many issues w the LoB we test. I’ve seen other teams that are jokes but don’t paint w such a board brush.
IT & V is a well-known farce . No real work happens at least on the teams that are supposed to test technology controls . The same teM members are sent to test the same controls under various pretexts - FFIEC, RCSA , etc . The. Tech control’s own EBCE and IT &V testing are indentical: both do not do a thing.
I worked at ITV a few years ago and you were heavily encouraged not to find anything. Or else….it’s a corporate scam. Don’t forget that the retail bank account opening processes (aka the fake accounts) were tested and deemed effective right before the scandal broke out.
IT&V have spent most of their time lately sitting into our EBCE evaluations (they say to save the SME's having to have a duplicate walkthrough) but all these no talent flunkies do is take our walkthrough down bunny holes with stupid and unrelated questions, we already have to beg focals to schedule our walkthroughs who insist we only need 30 minutes so that's what they book (I just decline with a reminder I stated 60 minutes not 30) but now we have to share it with IT&V green beans who can't even spell SOD let alone explain what it means.
The whole plan was to implement RCSA, to pass every control and bury any issues with the unsaid help of compliance. Sadly the RCSA roll out was so bad, they couldn't even demonstrate or fake it that they looked at anything! Compliance actively works to undermine any function from writing issues, because it makes them look bad and the unsaid rule, bury everything. If RCSA wasn't as bad as it ended up being, ITV was to be gutted and unknown amount of compliance and front line jobs sent to India. That's still the plan...
It&v has been doing busy work at best since they staffed up. They literally are making up things to test in an attempt to stay relevant. Also PD was a golden child who is now a red headed step child. Only a matter of time before they completely restructure (again) after everyone moves to EBCE to keep doing their “old” job.
Sounds like you need to go read sr 08-8 from the fed. We perform compliance testing to provide assurance we are complying with the law. That’s one of the core functions of ITV. I can get the criticism around the rcsas but compliance testing is pretty straightforward.
Complaint?
You are aimlessly conducting compliance testing to inform what? What are the boundaries? You issue a report saying you covered what? Lol
Regulations do not equal authoritative sources.
It’s mostly cr-p work. Results don’t align with company risk assessments.
It’s being conducted because compliance is a joke and can’t support the front line
I work in ITV and am lost by this convo. Incremental compliance testing is looking at whether we comply with the law. Rcsa testing is testing controls documented in the rcsa (which are cr-p currently). We are required to do compliance testing as a second line function. What is the complaint? We can’t do control testing until the first line gets their act together and gets fit for purpose rcsas and controls documented?
IT & V was always this unnecessary and unwanted child that was neither here nor there. The line one control functions can amply create and update controls. Third line can test controls (or lack thereof). Even with the low standard of audit here at Wells our third line folks can do some degree of shake-the-tree exercise to see if any beehive was up there. And the first line control functions , although they could not be controlled , had a viewpoint to help.
This then leads us to us , the poor souls of IT & V. People always called us "and we?". Unfortunately, the answer to that question is , "not really (needed)".
What is this about exactly?
Crushing it with no implementation strategy and past due reviews.
Oh, the horror, the horror. So many acronyms to confuse. Thanks for the alphabet exercise.
This is going to e EPIC, just wait until RTV gets involved with FVBS and pulls in HGTV!
Wait so what is happening? Are they siccing IT&V on RCSA?
People are being fired for finding controls weak and not changing their ratings when told to. The new policy is that there will be no failed controls, regardless of their effectiveness. If you won't change it, there are 1,000 indians we can hire that will do what we say.