First of all, Continuous Compliance has been a resounding success!

Thanks to all of our clients who have been progressive and confident in The Garland Group enough to move forward to a new risk assessment and audit methodology with us. We really think this is the way the industry is headed as far as risk based audits are concerned.

Interesting notes from doing a little Performance Review on Continuous Compliance:

• Over 75% of our audit clients use Continuous Compliance. That is a VERY HEAVY migration to Continuous Compliance for a methodology that is 2 years old.
• 17% of our clients just have IT audited once a year, by us.
• The remaining 8% of our clients have an extensive internal audit department that reviews IT. We'd like to see this percentage reduce to 0%.
• We are actively participating in many IT Steering Committees, giving us an opportunity unlike other audit firms to suggest additional Disaster Recovery, Compliance, Efficiency, Technology and Vendor Management ideas on a regular basis. We've been able to proactively mitigate MANY risks before we had to make recommendations.
• Examiners have reviewed our Continuous Compliance methodology at every size of our clients and have been pleased with the results. No recommendations regarding our methodology.
• Repeat findings have decreased at an estimated average of 75% per client. No more recommendations showing up year after year after year! (This was done with comparing 2009 reports to Q1 2011 reports)
• We have only recently implemented an interim reporting process. We conducted reviews in 2010 and told clients to let us know when they would like reports. This is a self admitted FAIL. We've corrected this by providing interim reports immediately after every section we review.

We've hit some speedbumps, but as you can see the methodology change has been a success.

Thanks to all the bankers who have made our process better and had the patience to work with us when we've made some mistakes.

We'd still like to hear any other process suggestions you have. Let us know in the comments or give us a call.