Data integrity forensics Bring transparency and trust to third-party data use

Transcription

1 Legal, Compliance and Technology Webcast Series Sponsored by EY Forensic & Integrity Services Bring transparency and trust to third-party data use 24 October 2018

2 Today s speakers Moderator: Eric Derk Ernst & Young LLP eric.derk@ey.com Speakers: Ryan Dobson Ernst & Young LLP ryan.dobson@ey.com Shawn Fohs Ernst & Young LLP shawn.fohs@ey.com Page 1

3 Agenda Issues facing third-party customer data misuse Typical risk scenarios A forensic approach to data integrity Case studies Our multidisciplinary approach Page 2

4 Recent news headlines A social media company revealed that a third party violated the terms of service and used its customer data to influence political elections through targeted advertisements. Raw data of more than 80 million profiles was improperly accessed and used. A company sold the personal information of financially distressed payday loan applicants to third parties, one of which used that data to withdraw millions of dollars from consumers accounts without their authorization. An online payment processing company listed on its website over 600 third parties with which it shares customer data. One of the world s largest ride service companies has a God View where they can track the whereabouts of its drivers and passengers in real time. Further, there have been reports of the company using the information in a way that violates relevant data privacy laws. A team of college professors and students found 43 confirmed cases of misuse across 817 of the top-ranked apps. Page 3

5 Questions about your customer data How is your company using your customers data? What are the data sources that you access for customer information? What analytics are you performing on your customer data? Are you sharing it, selling it or making your customer data available to third parties? What is expected from your customers and would they be surprised at your answers to the prior questions? Who are you sharing your data with? What agreement do you have as it relates to how your customer data can be used? What are the third parties actually doing with it? How do you validate? Have your vendors (e.g., outside counsel) returned or destroyed your customer data by agreed-upon terms when they complete the engagements? Have any of your vendors had to perform cross-border data transfers as required by the engagements? Do you know whether they adhere to the relevant data protection and privacy regulations as they relate to data transfer and potentially, data anonymization? Page 4

6 Attendee polling question #1 Which statements about your organization are true? (Select one.) 1 We have contract guidelines to define how we should address customer data use by third parties in contracts and we perform subsequent due diligence checks. 2 We have contract guidelines to define how we should address customer data use by third parties in contracts but we don t perform subsequent due diligence checks. 3 4 We don t have contract guidelines to define how we should address customer data use by third parties in contracts. It s up to each business unit s own discretion. Not sure. Page 5

7 Data protection and privacy regulations around the world Sample common questions to assess regulatory compliance: 1 General Data Protection Regulation (GDPR) The GDPR grants data subjects several core rights to access and control their data. To meet its requirements, organizations need to map the personal data of EU data subjects that they process, and ensure that it is processed appropriately and adequately protected. 1 Do you know how the personal information in your customer data is shared or used? 2 New York State Department of Financial Services (NYDFS) cybersecurity regulations NYDFS addresses data protection concerns in similar terms as the GDPR but further expands on the definition of nonpublic information to all information, even if not personally identifiable, or financial information that could cause a material adverse impact. 2 Do your vendors have adequate controls in place to secure customer data? 3 California Consumer Privacy Act (CCPA) of Are you sharing customers personal data without their consent? 4 The CCPA gives consumers the right to request access to and delete their personal information that a business has stored. They also have the right to opt out of a business selling their information. Asia-Pacific regulations The region has seen major developments in the implementation and enforcement of privacy and data security laws. To name a few: Australia s Privacy Act, Japan s Personal Information Protection Act and China s Cyber Security Law. Page 6

8 Getting started Build a governance team or piggyback on an in-flight program like information governance or privacy initiative Leverage data maps, data topologies and supply-chain data flows to pinpoint where customer data exists; make sure to include any third-party controller, processor or handler in this evaluation Ring fence all entities that handle customer data and define the ways and means, in which customer data is used by both internal and external parties Map customer data flows Review and update privacy and data handling acceptable-use policies Conduct impact assessments of all third parties as they relate to how data is managed, used and sold (don t forget about third parties that host data and services for your company) Develop a quality control plan for persistent oversight of how customer data needs to be managed Practice continuous improvement Page 7

9 Sample risk scenarios 1 Data analytics Data analytics that can reveal personal information, which would otherwise be unavailable in disparate data sources A vendor not removing or returning customer data upon the completion of a data analytics project 2 Data transfer and anonymization Local data protection and privacy regulations get triggered unintentionally during cross-border data transfer Ineffective data anonymization methods that cannot withstand the regulator challenges 3 Sales and marketing campaigns Out-of-contract-term processing and analysis of customer data for the success of sales and marketing campaigns Collect personal information of customers without their consent Page 8

10 Attendee polling question #2 Which area has the highest risk of customer data misuse in your organization? (Select one.) 1 Data analytics programs 2 Sales and marketing campaigns 3 Customer analysis 4 Cross-border litigation and investigation 5 None of the above Page 9

11 A forensic approach to data integrity Contractual review The nature of the customer data involved (personal information, banking data, health data, etc.) The scope of data (time frame, geographies, etc.) Approved data uses Data transfer and anonymization methods Storage locations Impacted IT systems and data sources Forensic analysis Vendor data review life cycle Gather preliminary information via third-party surveys Conduct live interviews as needed Perform digital forensic procedures on select systems and locations Third-party systems Findings and recommendations Produce findings and recommendations for internal control and compliance programs Develop remediation plans Address contract disputes and litigation preparation Customer data Page 10

12 Sample data forensic procedures Locations or systems Cloud, IT network and application systems Sample activities Perform searches using hash values of the raw data to determine data origin, flow and access. Use reverse engineering to identify tables, procedures and reports that touch, read, write or manipulate data Host-based system Search desktops of individuals who have had access to the data of concern to determine whether it was copied to local machines Social and collaboration systems Use network traffic logs to look for unauthorized use Page 11

13 Attendee polling question #3 What do you consider the biggest challenge for your organization in assessing third-party use of customer data? (Select one.) 1 Lack of central repository of all third-party relationships that involve customer data 2 Most of the contracts don t have clearly-defined terms as to how customer data can be accessed or used 3 Lack of forensics expertise to perform assessment 4 Lack of legal means to access third-party systems 5 None of the above Page 12

14 Case studies Page 13

15 Fraud risk assessment turned into data review Project background: To support the internal fraud risk analysis, as requested by the board of directors Business functions involved: general counsel s office, compliance, third-party risk management, procurement, risk, line of businesses Key activities and findings: Conducted interviews with executives and functional business owners to understand their view on internal and/or occupational fraud risks High percentage of risk concerns gathered from interviews were about third parties (e.g., consultants, contractors, technology vendors, service providers) who have access to the organization s IT systems, customer data and transactional records. Senior leaders viewed the role of monitoring the activities of third parties to fall in the hands of procurement. However, procurement viewed it as the responsibility of third-party risk management. There were parties not even in the register of vendors. Developed procedures to identify and map data ownership Designed procedures to centralize third-party management Drafted risk-review procedures and workplans for individual data audits Page 14

16 Third-party data controls review Review scope: Compliance with contractual requirements Prevention of unauthorized access to and misuse of data Key activities: Focused on the topical areas of organizational separation, technical safeguards, contractual compliance and auditability Facilitated questionnaires, site visits and subsequent requests for information Reviewed third-party documents, including policies and procedures, existing access agreements and process workflows Interviewed the third-party management and IT operational resources, and conducted business process walkthroughs with process owners to understand relevant roles and responsibilities, system architecture and application controls Tested access to certain systems Compiled fact-based observations Page 15

17 Third-party risk assessment Project scope: On-site Remote Lookback Key activities: On-site assessments: reviewed over 60 detailed on-site procedures across 15 risk domains Remote assessments: generated a third-party questionnaire, including over 500 questions across 15 risk domains Lookback assessments: validated and confirmed the risk ratings of 500+ services that rolled up to 100+ third-party families with the intent of performing assessments of the highest risk service within each family Page 16

18 Trade secrets forensic analysis Project background: The organization was concerned that its trade secrets were taken by a former employee who started a rival business overnight. Key activities: Performed forensic search and analysis procedures that identified over 2,000 documents on the rival business s computer systems. Presented finding to help legal counsel reach a settlement requiring the competing business to shutdown its operations. Examined close to 100 company and personal computers to assess whether the stolen assets were removed, as part of the business shutdown. Used forensic tools to permanently remove sensitive documents from the thirdparty s computers. Page 17

19 Third-party distributor assessment Project background: Annual compliance reviews of the company s distributors around the world Key activities: Reviewed, on-site, the third-party distributor s books and records maintained by the company s local operations to assess compliance with contractual requirements as they relate to the use of the company s data Collaborated with the internal audit department to develop a standard work plan, templates, communication protocols and reporting procedures for all global thirdparty distributor reviews Utilizes local-country resources to perform the fieldwork but oversaw all reviews centrally Page 18

20 Attendee polling question #4 Who do you view as having the responsibility to ensure compliance of customer data use by third parties? (Select all that apply.) 1 Internal audit 2 Legal 3 Compliance 4 IT 5 None of the above Page 19

21 Thank you Page 20

22 Sign up for upcoming webcasts How to prevent and respond to business compromise attack Thursday, 15 November :00 p.m. 1:00 p.m. ET Debunking the myths about blockchain and fraud risk Thursday, 13 December :00 p.m. 1:00 p.m. ET Data mining in the millennium age: social media discovery Thursday, 17 January :00 p.m. 1:00 p.m. ET Page 21

23 Contacts Eric Derk Ernst & Young LLP Ryan Dobson Ernst & Young LLP Shawn Fohs Ernst & Young LLP Page 22

24 EY Assurance Tax Transactions Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com. About EY Forensic & Integrity Services Dealing with complex issues of fraud, regulatory compliance and business disputes can detract from efforts to succeed. Better management of fraud risk and compliance exposure is a critical business priority no matter the size or industry sector. With approximately 4,500 fraud investigation and dispute professionals around the world, we will assemble the right multidisciplinary and culturally aligned team to work with you and your legal advisors. We work to give you the benefit of our broad sector experience, our deep subject-matter knowledge and the latest insights from our work worldwide EYGM Limited. All Rights Reserved ED None This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax or other professional advice. Please refer to your advisors for specific advice. ey.com