Privacy: Assessing the Risk

The objective of this report is to provide relevant information on the current state of privacy and data protection worldwide. General considerations and approaches to managing and evaluating privacy risk will allow business managers and auditors to identify and manage those risks.

Kim Hargraves, CPA, CISA, is the IT Audit Senior Manager at Microsoft Corporation. She manages the business/IT integration team for Microsoft Corporation. This team is engaged in audit support initiatives to assess systems risk and perform audits across all of Microsoft’s business units, and provide integrated systems audit support services for operations audits,systems development, and process reengineering. In addition, she is responsible for internal audit’s privacy assurance initiative and works closely with Microsoft’s Corporate Privacy Group in strategic areas in order to enhance the program and the company’s ability to ensure compliance with related laws, regulations, corporate directives, and best practices. Ms. Hargraves specializes in security and privacy, application development audits, and SAP audit and controls. Her past experiences include SAP security consulting and financial auditing for PricewaterhouseCoopers,and financial analysis for Specialty Brands.

Susan Lione, CIA, CCSA, CGAP, is Assistant Vice President of Research at The Institute of Internal Auditors (IIA) in Altamonte Springs, Florida. She has worked at The IIA since 1993. Prior to joining The IIA, Ms. Lione was Senior Auditor at Martin Marietta (now known as Lockheed Martin), as well as auditor for the Naval Audit Service in Jacksonville, Washington,DC, and Orlando. She has over 10 years of internal auditing experience and specializes in operational, compliance, and financial audits. Ms. Lione recently retired from the Air Force,having completed over 20 years of active duty and reserve service. Ms. Lione received her B.S. degree in accounting from Old Dominion University, and her M.B.A. from Florida Institute of Technology.

Kerry Shackleford, CPA, CISA, CCP, is the General Manager and sole employee of KLS Consulting LLC, a Colorado limited liability company formed in 2002. He has 17+ years of experience consulting with clients on matters of business and technology risk assessment and management. Prior to starting this new venture, Mr. Shackleford led Arthur Andersen’s worldwide privacy and data protection practice. Mr. Shackleford has a working knowledge of fair information practices generally and the requirements of specific U.S. privacy regulations such as GLBA, HIPAA, and the US/EU Safe Harbor program. Mr. Shackleford holds a bachelor of arts degree in computer science and a concentration in accounting from Baylor University in Waco, Texas.

Peter Tilton, CPA, CISA, is the Director of IT Audit Services at Microsoft Corporation. He leads several Internal Audit Services initiatives to assess IT risk and strategy across the company,including worldwide security policies and practices, IT application and infrastructure security, electronic commerce, and integrated systems audit support services for operations audits, systems development, and process reengineering. Mr. Tilton’s group also performs a key role within Microsoft Internal Audit Services to help envision and develop technology solutions to manage the audit process more effectively. He is a member of The IIA’s Advanced Technology Committee, and recently led the development of Systems Assurance and Control (SAC), The IIA’s framework and guidance to help understand, assess, monitor, and mitigate technology risks. Before joining Microsoft in 1996, Mr. Tilton worked for Price Waterhouse in Denver.