Preparing for an SSAE 16 Audit is a lot like Traveling with Kids

Preparing for an SSAE 16 Audit is a lot like Traveling with Kids

Even as my kids get older, getting out the door still takes too long and there is way too much yelling (or so my kids tell me).  Everyone knows what they need to do to get ready, what they need to bring, and when we’re leaving. Yet when the time comes to depart for our winter getaway, our final check reveals that my son didn’t pack any socks and my daughter packed for the right number of days, but is bringing dress up skirts instead of regular clothes, and cowboy boots, not snow boots.

How did we come to this?  We made it very clear what we needed to do and then I sent the kids off to do their thing.  In some form or another, everyone got packed.  I see the luggage, but it’s what’s inside that doesn’t meet our expectations.  This scenario is a lot like preparing for an SSAE 16 audit. With well over 100 potential processes, procedures, and artifacts needed to demonstrate that we do things the right way, and do what we say, we’re bound to be missing some socks and have a few skirts instead of snow pants.

Fortunately, the Performance Services team has process and continuous improvement in our DNA.

As we started mapping our processes to the Trust Service Principles, it became clear that our team had done significant work on developing and following processes.  Run books, incident management processes, security procedures and change management were all documented.  Even better, our gap analysis indicated that, in most cases, we’re doing things the right way.  That validation is important, not just as a manager overseeing the process, but for a consistent delivery to our clients.

We’ve put tools in place, such as ServiceNow, Secret Server, and EM7, to help the team adhere to the process.  The challenge with a large team is that tools can become like the kids suitcases if you don’t regularly reinforce what needs to be in there. Our recent gap analysis highlighted that we need to be more specific on the types of artifacts we expect the team to enter into ServiceNow, our IT Service Management tool.  After reviewing a group of change tickets, we discovered that a couple of the tickets had incomplete information. In order to resolve this gap, we followed up with the change owners and found that even though the details weren’t in the ticket, they could provide the needed information (testing plan, rollback procedures, etc.).  While this validated that we are following the process, we changed our training to focus on making sure all data gets into the system during change definition.  We all get busy, but focusing attention on these tasks is what helps separate us from our competition.

Additionally, centralized and accessible policy information is an area where we can improve.  Our team has done a lot of great work creating this process but making sure everyone, not just the folks on your team, has an easy way to review that policy or procedure is important to delivering consistent service.    In preparation for the analysis, we created a centralized process repository. Regular training will make sure people know where to look to keep focused on how we deliver our services.

With the actual audit period a few months away, we have time to update our policies to provide even greater clarity and to retrain the team on our expectations.  More importantly, we have time to socialize the rigor needed to maintain this level of execution.  Sending my kids off to pack is one thing, but making sure I check in and verify what they’re packing will ensure the right types of items make it into the suitcase.

For my next road trip, I’m going to spend a little more time working with my kids to make sure they’ve got everything they need to enjoy their journey.  As a leadership team, we’ll pay even greater attention to the details on how we deliver industry leading services to our clients.

Our attestation will validate that we are doing what we say we do.  In the end, the real value of an SSAE16 review is the attention to process and detail that it requires from each and every team member.  The benefits from that will continue to reverberate through our teams and our clients, which will lead to better products and service.

I’ll follow up during the audit period and provide an update on our journey.


Phone: 312-602-4000
222 W. Adams
Chicago, IL 60606
Show Buttons
Share On Facebook
Share On Twitter
Share on LinkedIn
Hide Buttons