IllumiDesk Security Docs
  • IllumiDesk Team Handbook
  • People Group
    • Introduction
    • General Employment
    • Employment Status & Recordkeeping
    • Working Conditions & Hours
    • Employee Benefits
    • Employee Conduct
    • Timekeeping & Payroll
  • Security and Compliance
    • Security Controls
      • BC.1.01 - Business Continuity Plan
        • IllumiDesk Business Continuity Plan
        • IllumiDesk Disaster Recovery
        • IllumiDesk Reference Architectures
        • IllumiDesk Handbook listing of DR for Databases
      • BC.1.0.2 - Business Continuity Plan: Roles and Responsibilities
      • BC.1.03 - Continuity Testing
      • BC.1.04 - Business Impact Analysis
        • Business Impact Analysis in the handbook
        • Data Protection Impact Assessment (DPIA) Policy
        • Data Protection Impact Assessments or DPIAs
        • UX Department
        • Triage Operations - Communication about expected automation impact
        • NIST BCP with reference to BIA
      • CFG.1.01 - Baseline Configuration Standard
        • Laptop or Desktop System configuration
        • Configuring New Laptops
        • Security Best Practices
      • CFG.1.03 - Configuration Checks
        • Production Change Requests Policy
      • CM.1.01 - Change Management Workflow
      • CM.1.02 - Change Approval
      • CM.1.03 - Change Management Issue Tracker
      • CM.1.04 - Emergency Changes
      • DM.1.01 - Data Classification Criteria
        • Data Classification Policy
      • DM.2.01 - Terms of Service
        • Application Terms of Use
      • DM.4.01 - Encryption of Data in Transit
        • Deprecate support for TLS 1.0 and TLS 1.1
      • DM.7.03 - Data Retention and Disposal Policy
      • IAM.1.01 - Logical Access Provisioning
        • Access Requests
        • Access Management Process
      • IAM.1.02 - Logical Access De-Provisioning
        • Access Management Process
        • Logical Access Deprovisioning
        • Access Reviews
        • IllumiDesk Offboarding Guidelines
      • IAM.1.04 - Logical Access Review
        • Access Reviews
      • IAM.1.05 - Transfers: Access De-Provisioning
        • Access Control Policy and Procedures
        • Job Transfers
        • Access Change Request
      • IAM.1.06 - Shared Logical Accounts
        • Security Process and Procedures for Team Members
        • Access Management Process
      • IAM.1.08 - New Access Provisioning
        • Access Requests
        • Access Management Process
      • IAM.2.01 - Unique Identifiers
        • Unique Account Identifiers
        • Access Control Policy and Procedures
        • Section on shared accounts in Okta handbook page
        • Access Management Process
      • IAM.2.02 - Password Authentication
      • IAM.2.03 - Multi-factor Authentication
      • IAM.3.02 - Source Code Security
      • IAM.4.01 - Remote Connections
      • IAM.6.01 - Key Repository Access
      • IR.1.01 - Incident Response Plan
      • IR.1.03 - Incident response
      • IR.1.04 - Insurance Policy
      • IR.2.02 - Incident Reporting
      • NO.1.01 - Network Policy Enforcement Points
      • PR.1.01 - Background Checks
      • RM.1.01 - Risk Assessment
      • RM.1.02 - Continuous Monitoring
        • Security Compliance
      • RM.1.04 - Service Risk Rating Assignment
      • RM.1.05 - Risk Management Policy
      • RM.3.01 - Remediation Tracking
      • SDM.1.01 - System Documentation
      • SG.1.01 - Policy and Standard Review
      • SG.2.01 - Information Security Program Content
      • SG.5.03 - Security Roles and Responsibilities
        • Incident Management Roles and Responsibilities
      • SG.5.06 - Board of Director Bylaws
        • Governance Documents
      • SG.5.07 - Board of Directors Security Program Content
        • Audit Committee Agenda Planner
      • SLC.1.01 - Service Lifecycle Workflow
      • SLC.2.01 - Source Code Management
      • SYS.1.01 - Audit Logging
      • SYS.2.01 - Security Monitoring Alert Criteria
      • SYS.2.07 - System Security Monitoring
      • TPM.1.01 - Third Party Assurance Review
      • TPM.1.02 - Vendor Risk Management
      • TRN.1.01 - General Security Awareness Training
        • Security Awareness Training
      • TRN.1.02 - Code of Conduct Training
      • VUL.1.01 - Vulnerability Scans
      • VUL.1.03 - Approved Scanning Vendor
      • VUL.2.01 - Application & Infrastructure Penetration Testing
      • VUL.3.01 - Infrastructure Patch Management
      • VUL.3.02 - End of Life Software
      • VUL.4.01 - Enterprise Protection
      • VUL.5.01 - Code Security Check
      • VUL.6.01 - External Information Security Inquiries
  • VPAT Version 2.3
Powered by GitBook
On this page
  • Management, Accounting and Reporting
  • People Division
  • Legal, Risk and Compliance
  • Security Compliance
  • Internal Audit
  • External Audit
  • General
  1. Security and Compliance
  2. Security Controls
  3. SG.5.07 - Board of Directors Security Program Content

Audit Committee Agenda Planner

We review the below topics no less frequently than the following schedule:

Management, Accounting and Reporting

Topics
FY Q1
FY Q2
FY Q3
FY Q4

Accounting policies

X

X

Significant estimates and judgements

X

New accounting standards – impact and implementation plan

X

X

X

X

Review of financial Statements

X

Related party transactions

X

Treasury

X

ERM – Review of financial statement risk factors

X

Insurance coverage update

X

Close process

X

Stock transactions

X

Tax audits / Taxes

X

Public reporting (GAAP and Non-GAAP financials, non-GAAP metrics)

X

Guidance model

X

People Division

Topics
FY Q1
FY Q2
FY Q3
FY Q4

Global staffing update, succession plan and continuous improvement

X

EEO audits

X

Payroll

X

Compensation and hiring

X

Legal, Risk and Compliance

Topics
FY Q1
FY Q2
FY Q3
FY Q4

Compliance to business conduct (including hotline complaints and code of conduct violations)

X

ERM – Risk assessment updates

X

Regulatory compliance

X

Privacy

X

Reg FD - Fair Disclosure

X

Reg G - Governance

X

Committee annual assessment

X

Security Compliance

Topics
FY Q1
FY Q2
FY Q3
FY Q4

ERM – Cyber risk assessment

X

Cybersecurity

X

Application system reviews: Tech Stack - for accounting function & GCF handbook 1. Accounting - Netsuite 2. Tax - Avalara 3. Stock - Carta 4. Planning - NA 5. HR - Bamboo HR 6. License provisioning - Zuora 7. Commission system - Captivate

X

IT implementation projects and initiatives

X

IT security update

X

Internal Audit

Topics
FY Q1
FY Q2
FY Q3
FY Q4

Internal audit and global annual plan

X

Internal audit activity report and annual plan update

X

X

X

X

SOX - Internal control over financial reporting assessment and deficiencies status update

X

X

X

X

Internal controls (pre-Sox)

X

Internal audit charter review

X

Fraud Risk assessment

X

X

Annual assessment of internal audit

X

X

External Audit

Topics
FY Q1
FY Q2
FY Q3
FY Q4

Global audit plan and fees/Appoint External Auditor

X

X

Year-end audit results and required communications, as applicable

X

X

Annual assessment of audit firm, engagement team and lead audit partner

X

Independence review

X

X

Audit

X

General

Topics
FY Q1
FY Q2
FY Q3
FY Q4

Executive session - as needed

X

X

X

X

Approval of minutes

X

X

X

X

Committee annual assessment

X

Closed session as needed

X

X

X

X

PreviousSG.5.07 - Board of Directors Security Program ContentNextSLC.1.01 - Service Lifecycle Workflow

Last updated 1 year ago