Peter Konrad-Graduate in Business Administration (FH)

Analysis and optimization of various processes in the areas of information security, business continuity management, and outsourcing management

• Recording and analyzing current processes, identifying optimization potential in the area of officer roles (ISB, BCB, outsourcing officer)
• Creating training materials (presentation) to raise awareness among decentralized service managers
• Evaluating data quality in the GRC tool to show further improvements (in information security and outsourcing management)
• Quality assurance of the RMR report according to DORA
• Support in carrying out ISM audits
• Support in optimizing the BIA / RIA

Handling various issues | Preparing various gap analyses

• Providing an overview of all DORA-relevant topics
• Preparing an overview of DORA-relevant ICT risks
• Assessing the tasks and role of the service provider in serious incidents (including delimitation criteria, information to be provided as part of the initial report, follow-up report, and final report)
• Comparing the report content within the reporting that a service provider has to deliver under DORA

Consulting on the implementation of DORA requirements

• Support and guidance for the business units in carrying out the GAP analysis to identify existing deviations from the DORA regulation (including the requirements under RTS / ITS)
• Analysis and advice for the responsible owners on the implementation of, among others, the following DSGV short guides:
• classification of the category "critical or important function" derived from the BIA
• strong authentication
• risk management framework (RMR)
• quality assurance of adapted / created strategies, policies and guidelines (2nd LoD) to ensure proper implementation of the DORA requirements
• quality assurance of concepts (1st LoD), for example the cryptography concept, to ensure proper consideration of the DORA requirements
• support for the measures to be carried out within the scope of the following four pillars of the DORA regulation:
• ICT risk management
• reporting of ICT-related incidents
• testing of operational resilience
• ICT third-party risk

Advice to top management on special topics, such as the upcoming Section 44 audit or regulatory requirements for segregation of duties

• quality-assurance review of OHB rules and regulations to identify implausibilities or declining quality at an early stage
• test interviews (coaching) with the responsible owners to point out improper or suboptimal behavior
• assessment and evaluation of the OHB documents with regard to proper implementation of the regulatory requirements in accordance with AT9 MaRisk
• support with the preparatory and implementation measures to ensure a technical mapping of a segregation-of-duties review in the bit-MaRisk application

Optimization and execution of the audit methodology (internal audits and provider assessments) within information security

• Analysis and assessment of the existing audit methodology
• Optimization of the audit approach based on a robust, risk-oriented approach, including ISO/IEC 27001 controls
• Development of an audit tool (so-called audit guide) to support audits in all phases (preparation/definition of audit focus areas, execution, reporting and follow-up)
• Development of a risk-oriented planning approach for the 5-year plan and the annual audit plan for carrying out provider assessments based on a scoring system
• Creation of a self-assessment questionnaire as a methodological approach for carrying out provider assessments
• Carrying out various provider assessments, including on-site audit activities (data center audits), document reviews and remote interviews

Support for the annual financial statement audit of an investment management company:

Planning, execution and documentation of audit procedures with the following focuses:

• outsourcing management and provider steering in accordance with AT9 MaRisk
• business continuity management
• IT strategy and IT governance
• IT operations
• segregation of duties principle and toxic rights within rights management

Execution of quality assurance measures for the audit procedures and results of junior auditors

Conducting IT audits with the following focus areas:

Integrated IT/business audits based on COSO II / COBIT 5:

• Review of access rights management at the level of various applications, databases (including Oracle, MS SQL) and operating systems (including Linux, Unix and MS Windows)
• Review of change management at the level of various applications, databases (including Oracle, MS SQL) and operating systems (including Linux, Unix and MS Windows)
• Review of further ITIL-based services, such as problem and incident management, service level management, capacity management, availability management, IT service continuity management, information security management, compliance management, supplier management
• Review of the ERP system SAP ERP 6.0 and the trading system SUMMIT, with focus on
• emergency user management
• user management
• authorization management
• change management
• configuration management
• system integrity at SAP/SUMMIT, DB and OS level
• Review of further audit areas according to IT General Controls (ITGC)
• Validation of the audit results of the ISMS audit according to ISO27.00x
• Teaching audit methodology within the IT audit team

Independent IT audits based on COSO II / COBIT 5:

• Audit of the implemented information security system according to ISO 27.00x and in line with BAIT requirements, with the following focus areas:
• Review of the implementation and effectiveness of the elements of information risk management
• Assessment of the defined and implemented information network and its components and dependencies
• Review of the assessment of protection needs with regard to the relevant protection goals
• Review of the structure and suitability of the target measures (target/target or target/actual comparison)
• Validation of the risk analyses to be carried out regularly
• Review of the implementation and effectiveness of the elements of information security management
• Assessment of the design, completeness, traceability and effectiveness of the rules relevant to the ISMS or the written internal policies (guidelines, policies and work instructions)
• Validation of the organizational structure relevant to the ISMS
• Review of the design and effectiveness of the ISMS internal control system

Management of Internal Audit and optimization of audit processes:

Leading the audit team and responsible for the following tasks:

• Ensuring the quality, adequacy and timely completion of audits according to the 2019 audit plan
• Leading and managing the audit team consisting of three internal and several external employees (> 10), including one Big4 firm
• Regular reporting to management, the corporate group and customers
• Preparing the risk-based audit plan for 2020
• Audit-compliant advice to business units and management

Consulting and implementation tasks as part of the qualitative optimization of audit processes and ensuring the effectiveness of Internal Audit:

• Revision of the audit manual taking into account the requirements of Audit Standard No. 3 (DIIR) and the principles of proper auditing of internal audit systems (according to IDW PS 983)
• Derivation and implementation of improvement measures according to the audit report of the auditor under IDW PS 983 (principles of proper auditing of internal audit systems)
• Conducting workshops within the audit team to explain the requirements for the effectiveness of an Internal Audit function according to DIIR Audit Standard No. 3 (Audit of Internal Audit Systems (Quality Assessments))

Conducted IT audits with the following focus areas:

Data Protection Officer as part of GDPR implementation:

• Appointment of the data protection officer with the supervisory authority
• Organizational and operational structure within the data protection function (data protection management system)
• Organizational framework of the data protection function
• Fulfillment of data subject rights by the controller
• Implementation of the data protection impact assessment
• Structure and content of the record of processing activities
• Proper implementation of risk management as part of technical and organizational measures, the reporting obligation for data protection breaches, and the data protection impact assessment
• Completeness and appropriateness of data processing agreements (DPAs)
• Conducting training sessions as part of GDPR implementation
• Implementation of information obligations at the first collection of personal data
• Completeness of confidentiality agreements for employees and service providers

Data center audit as part of a housing data center service provider:

• Appropriateness of the service contract and monitoring of compliance with service level agreements
• Building and property security of the provider
• Access control and monitoring of access
• Communication and escalation processes between client and contractor
• Reliability of cooling and power supply (redundant supply / UPS)
• Emergency power supply and other measures within business continuity management (diesel generators)
• Early fire detection and smoke alarm systems
• Carrying out regular maintenance activities
• Operations and security control center (confidentiality of deployed staff)
• Cable routing

Carried out IT audit procedures as part of the following internal audit reviews

• Custody accounts, fund process, marketing & sales
• Validation of the appropriateness of protection needs information in the CMDB of systems relevant to the audit
• Review of the minimum documentation of systems relevant to the audit for completeness and content plausibility
• Conducting audit interviews with the technical and business contacts responsible
• Preparation of the working papers needed for the audit report
• Assessment and categorization of audit findings according to the COSO methodology

external data protection officer

• Preliminary analysis of the current compliance with data protection requirements for the implementation of a data protection management system (DSMS) in order to prepare the company for compliance with the EU General Data Protection Regulation (EU GDPR)
• Processing / advising on data protection-related requests from project and business departments
• Requirements for a privacy policy
• Preparation for anonymization / pseudonymization of data material
• Data protection requirements for the use of customer terminals
• Requirements regarding controlled access to employee email accounts and personal shared drive access
• Advice and support in connection with upcoming data processing on behalf
• Review of work packages within the EU GDPR project
• Requirements for the use of webcams
• Use of profiling and automated individual decision-making
• Review and control of data processing on behalf
• Training and onboarding the future internal data protection officer
• Close cooperation with the legal department
• Compliance with data protection regulations

Coordination and execution of IT audits

• Significant contribution to the audit planning (especially the IT part)
• Carrying out IT audits in line with the audit plan (joint audits: BCM, provider management)
• Audit support for a large IT project
• Coordination of audits by the supervisory authority and group audit
• Technical responsibility for carrying out audits in the IT audit team
• Administrative support for the audit management

Implementation project for a provider selection process for cloud computing providers

• Conceptual process development for selecting cloud services and their providers
• Creating service scorecards for each provider
• Analysis of the relevant written policies and procedures
• Adjusting the written policies and procedures and adding cloud computing relevant aspects
• Developing XLS-based tools to support the selection process
• Creating management presentations
• Regular presentation of interim/final results

Conceptual development of a Balanced Security Scorecard and a provider management system as part of an ISMS project in accordance with ISO 27.00x

• Analysis of the ISMS structure and process setup
• Conceptual development of an ISMS organization and governance based on the group-wide security requirements
• Adaptation of the security-relevant written policies and procedures

Implementation project of an ISMS in accordance with ISO 27.00x

• Assessment of ISMS-related audit findings using a risk system
• Conducting interviews based on the information security findings
• Development of measures to resolve or reduce existing risks
• Conceptual development and creation of security policies and standards

Building and managing the company

• Building the company's organizational structures
• Building and developing consulting services (IT audit & security, outsourcing services, expert services, business administration, governance/compliance)
• Initiating and closing strategic partnerships with business partners to expand the service portfolio and increase customer potential and revenue
• Conducting sales activities (both cold calling and existing client development)
• Data protection officer for the entire group of companies
• Handling audit assignments according to IDW PS 330 (IT system audit), IDW PS 951 (audit of the internal control system at the service provider), IDW PS 850 (project-related audit) and IDW PS 880 (audit of software products)

Coordination and execution of IT audits

• Responsibility for the overall audit process to ensure the functionality of internal IT audit in line with BaFin MaRisk
• Preparation of audit plans according to IIA (Institute of Internal Auditors) standards
• Organization and coordination of audits
• Responsibility for conducting audits according to IIA and DIIR (German Institute of Internal Auditors) standards
• Conducting IT system audits according to IDW PS 330
• Quality assurance of aligned activities
• Implementation and adaptation of risk- and control-based audit approaches
• Project support for integrating a new business unit (France) into the corporate group according to company standards
• Project responsibility (Germany) for the project "SAP R/3 migration and release change to ECC 6.0" as part of the group-wide consolidation of the heterogeneous SAP R/3 system landscape

Coordination and execution of IT audits

• Implementation of a risk-based audit approach when setting up internal IT audit as a sub-area of the overall audit department
• Audit of the group-wide risk management system with a focus on IT risk management
• Advisory support in implementing a risk management process for operational IT risks
• Responsibility for building up internal IT audit as a sub-area of the overall audit department

Coordination and execution of IT audits

• Implementation of a risk-based audit approach when building up an IT audit function as part of the overall audit department
• Audit of the bank-wide risk management system with a focus on IT risk management
• Advisory support in implementing a risk management process for operational IT risks
• Responsibility: building up the IT audit function as part of the overall audit department