Process Assurance Project Manager

My name is Hannah Micsell, and right now I work as a process assurance project manager which means I'm in an IT risk and control function. So right now I work, like I said, for an application development team in an IT function for a large financial services firm. And what I do is I leverage my audit background to provide them with some assurance over their common risks and the types of controls they should have. In the function like theirs, they might have the risk of inappropriate access, folks who shouldn't have access to certain applications, systems or servers might need to have that access periodically reviewed to make sure that it's appropriate. Another risk might be corrupted code deployed to production that could pose a vulnerability to the application systems and servers they're trying to use. So in auditing, you learn how to map out the proceesses in any organization or department. Identify the key risks that could potentially pose a threat to that organization or function and then help that team assess their controls or maybe identify gaps where they need new controls. So that's what I started doing on the financial side and then later, I moved into IT. So I help management pay attention to the portfolio of applications that they build and maintain and we try to risk rank those to have an idea where we should start. There's so much to do, we can't pay attention to everything so we try to prioritize, I work that way. Once we've started decided what we're gonna do and how we're gonna do it, I'll work with the folks that own those applications to perform any activities they need to. If I'm aware of any gaps, I'll bring it to their attention and vice versa. And then I provide regular reporting to management on how we're doing with those activities. One thing that we did last year when I first came on board was we did our first risk and control self assessment, so we took some industry standard risks and controls leveraging certain industry standard control frameworks like COBIT is an example some people may have heard of. So we took those expected controls and map them against what we thought was actually present in the organization. Since it was the first time we had done that exercise, it was really neat to be a part of building that framework for the company I work at.