Auditopia | DevensaAdvisory | Activity

DevensaAdvisory posted an update in the group DEVENSA: A payment vendor goes offline for six hours. […]

Fri, 23 Oct 2026 18:57:15 -0500

A payment vendor goes offline for six hours. Operations rates the outage high, finance rates the event medium, security rates the event low, and legal gives no rating until a customer complain. The 2026 NC State and AICPA State of Risk Oversight study found only 29% of organizations have formally articulated a risk appetite, so this scene shows…

DevensaAdvisory posted an update: In 2015, Equifax's own internal audit flagged more […]

Wed, 21 Oct 2026 16:35:53 -0500

In 2015, Equifax’s own internal audit flagged more than 8,500 overdue vulnerabilities, including over 1,000 on external-facing systems, and no one ran a follow-up audit. Two years later, attackers got in through an unpatched Apache Struts flaw and reached data on about 148 million people. Our new Root Causes post traces how a documented…

DevensaAdvisory posted an update: Only 50% of organizations keep a full inventory of […]

Fri, 16 Oct 2026 18:41:09 -0500

Only 50% of organizations keep a full inventory of vendors with network access, and 47% had a third-party access breach in the past year (Ponemon and Imprivata, 2025). When a vendor takes custody of your data, you keep ownership and accountability, but most contracts rarely spell out derived-data rights, AI training use, or deletion at exit.…

DevensaAdvisory posted an update in the group DEVENSA: Your vendor file has a signed contract, a SOC 2 report, […]

Wed, 14 Oct 2026 19:26:45 -0500

Your vendor file has a signed contract, a SOC 2 report, an insurance certificate, and a clean sanctions screen. Every reviewer signs off, and the file still proves nothing, because none of those documents shows anyone read, questioned, or acted on them. Gartner found 83% of organizations spotted third-party risks after due diligence and…

DevensaAdvisory posted an update in the group DEVENSA: Vendor questionnaires come back complete, contracts […]

Tue, 06 Oct 2026 20:06:12 -0500

Vendor questionnaires come back complete, contracts carry signatures, and the vendor file passes review. Then the vendor gets breached, and nobody saw the warning signs. Auditors, what is the one piece of evidence you ask a vendor for when the questionnaire answers look too clean? Share the request in the comments and tell us what the…

DevensaAdvisory posted an update in the group DEVENSA: AI vendors change their models after you approve them, […]

Mon, 05 Oct 2026 17:11:40 -0500

AI vendors change their models after you approve them, often without telling you. MIT Sloan Management Review and BCG found 55% of AI-related failures came from third-party AI tools. Our new post shows five checks to add to your next AI vendor audit. What do you ask AI vendors about model changes, and what answers have you gotten back?

auditopia.com

Auditing AI Vendors: Third-Party Risk When the Product Learns – Auditopia

DevensaAdvisory posted an update in the group DEVENSA: Your policy says quarterly access reviews. Your last […]

Tue, 29 Sep 2026 20:22:34 -0500

Your policy says quarterly access reviews. Your last one happened 14 months ago, and you still passed the audit.

Which checkbox gets ticked most often without the work behind it?

Access reviews
Vendor risk assessments
Incident response drills
Security awareness training

DevensaAdvisory posted an update in the group DEVENSA: You see 100 percent attestation on the code of conduct […]

Mon, 28 Sep 2026 22:05:43 -0500

You see 100 percent attestation on the code of conduct in almost every compliance audit. LRN’s 2025 research found only 44 percent of organizations test whether employees understood what they signed. The DOJ calls a program built on sign-offs alone a paper program. When you audit compliance, do you test for comprehension or stop at the attestation log?

auditopia.com

The Policy Nobody Read – Auditopia

DevensaAdvisory posted an update in the group DEVENSA: Only 30% of organizations factor risk exposure into […]

Fri, 25 Sep 2026 19:16:54 -0500

Only 30% of organizations factor risk exposure into capital allocation decisions, the exact moment a risk appetite statement is supposed to matter. When was the last time yours actually changed a decision? Share your experience in the comments.

auditopia.com

Risk Appetite: The Statement Everyone Writes and No One Uses – Auditopia

DevensaAdvisory posted an update in the group DEVENSA: Median patch times jumped from 32 to 43 days last year, […]

Wed, 23 Sep 2026 19:03:41 -0500

Median patch times jumped from 32 to 43 days last year, and it made me wonder how many “effective” patch controls are really just testing whether a policy exists. The real question is how long a known exploited vulnerability sits open, not whether the schedule looks good on paper. Auditors, when you test patch management, are you measuring…

auditopia.com

Patch Management Isn’t a Checkbox – Auditopia

DevensaAdvisory posted an update in the group DEVENSA: Pick any policy your organization has on file today. If […]

Tue, 22 Sep 2026 20:41:02 -0500

Pick any policy your organization has on file today. If you couldn’t produce evidence beyond the document itself, would you be confident it’s actually being followed?

DevensaAdvisory posted an update in the group DEVENSA: Here's a 3-sentence blurb for the Devensa […]

Mon, 21 Sep 2026 20:08:30 -0500

Here’s a 3-sentence blurb for the Devensa group:

Most companies think they have an AI policy, but a one-page “don’t paste client data into ChatGPT” memo isn’t governance, it’s a start. This post breaks down what a real AI policy actually needs: clear ownership, approval thresholds, data rules, and incident response that is anchored to…

auditopia.com

What a Real AI Policy Actually Contains – Auditopia

DevensaAdvisory posted a new activity comment

Fri, 28 Aug 2026 20:29:32 -0500

@kara-0325 I worked in hospital admin for years and experienced the same thing. Have you had any big “oh, oh no” moments? I worked for a small surgical hospital where their cybersecurity was expired Norton Antivirus and felt that cybersecurity training didn’t need to be a thing.

In reply to - Alyssa posted an update in the group DEVENSA

This group exists for one reason: governance and audit sit closer together than most organizations act like they do. You spend your career documenting what […]