2011年6月5日 星期日

PCI DSS Certification - Is It Mandatory To Perform Third Party PCI Compliance Audit And PCI Scan?


PCI DSS certification stands for Payment Card Industry Data Security Standard. PCI Data Security Standard has been established by the top five credit card issuing companies, MasterCard, Visa, American Express, Discover and Japanese Credit Bureau, who took their individual security standards for online transactions and merged them into one, establishing the PCI Data Security Council at the same time. The Council is a self-regulatory body which updates the PCI DSS requirements from time to time, trains companies and issues training certificates for companies who then act as PCI Audit executors, and PCI Qualified Security Assessors QSA.

As the online threats multiply in the direction of where the money is (online), the original 12 rules of PCI DSS compliance has evolved and today, as some affected merchants like to say, the 12 rules have over 200 sub-rules that are difficult to interpret, and correspondingly difficult to fulfill. It likely involves annual reporting by a qualified assessor, QSA, and quarterly scanning of outward-looking internet connections by a ASV, Approved Scanning Vendor. Both of which translate to additional costs to the merchant who must undertake the PCI Data Security Standard certification compliance.

So if you are a merchant processing online or point of sale transactions using credit and debit cards, the question comes up, is it mandatory to perform a PCI compliance audit and a PCI scan through third parties?

We'll point out here the two possible routes for a merchant to avoid costly third party PCI DSS audits and PCI scans and still be PCI compliant. They are: Have fewer than 20,000 payment card transactions in a year, and, Get someone from the company PCI DSS Audit qualified, have them become an ISA, Internal Security Assessor. We will talk about the current PCI DSS 2.0 version.

Have fewer than 20,000 payment card transactions per year

If you are relatively small merchant with fewer than 20,000 transactions in a year, you will be able to fulfill the security requirements by doing an internal security audit and simply fill out a Self-Assessment Questionnaire. There are several types of questionnaires. You can work with your "acquirer", or the bank through which you are processing your payment card payments to determine which questionnaire is right for you and what are the deadlines for submitting them.

Have someone from within your company PCI DSS Audit qualified

On the opposite end of the spectrum, if you are a large merchant, or a large online service organization, and you have more than 20,000 transactions per year, you can avoid hiring a third party PCI DSS Qualified Security Assessor by simply sending one of your IT professionals to one of the PCI DSS standard compliance seminars to become qualified as an Internal Security Assessor, thereby removing the need for external PCI Audits. The PCI data security standard checklist audits can from now on be done in house by an ISA. ISAs must be re-certified every year, and the company can now perform their own security audits and still stay PCI compliant.








For more information on the details of PCI DSS compliance see the PCI Compliance section on the site http://PCIscanning.org.


2011年6月4日 星期六

Self-Employed Woes


Cheating on taxes is common among self-employed people, so you have a high chance of being audited, even if you pay taxes on time and run an honest living. The Small Business/Self-employed Division of the IRS employs the most staff.

An audit notice will require information regarding:


If you have workers who have been classified as independent contractors when they are actually employees
Payroll tax deposits are paid properly
If you declared all cash transactions
If you have large claims for business entertainment expenses
If you have reported car expenses for travel expenses that weren't business-related
If your lifestyle takes more than the sum of self-employment income you declared
If you write off living expenses as business or home office expenses
Declared all the business' sales and receipts


As you can tell, it is vital to keep good records. When and if an audit happens, you'll have the needed documentation the IRS requests.

You can lower your risk of an audit through these tips:


Avoid math mistakes. The IRS may want to investigate you if you have multiple math mistakes on your tax return.
Do not fail to sign your tax return because the IRS will think you have forgotten other things.
Donations shouldn't be overestimated. Use the market value for any donations and if you have donated a big value item, obtain a letter from an appraiser for your files.
Don't underreport your income because the IRS can examine your accounts.
Cash transactions must not be hidden. Cash transactions above $10,000 should be reported on IRS Form 8300 within the fifteenth day after the date of the transaction.
Don't overestimate home office deductions. If the room your home office is in is utilized solely for that purpose, you can deduct the expense. Keep good records on the fraction of the utilities and insurance required to keep that room functioning as a home office.
Payroll tax payments must not be failed. The IRS considers this as unlawfully borrowing funds from the Government if these taxes are not settled.
Live within your means.


The IRS might audit you if:


increase in income
a partnership
change in lifestyle
tax shelter investments, or a trust
hiring relatives
employing employees vs. hiring independent contractors


You will be able to convince the IRS that you operate an honest living if you settle your taxes promptly and keep accurate records. The IRS may audit you for three years after you file a return, so keep your records for at least three years.








Darrin T. Mish is a Nationally recognized Attorney whose practice focuses on representing clients across the United States with IRS Problems. He is AV rated by Martindale-Hubbel and is a member of the American Society of IRS Problem Solvers and the Tax Freedom Institute. He has been honored by a listing in Martindale-Hubbel's Bar Register of Preeminent Lawyers. His passion is providing IRS help to taxpayers with both individual and payroll tax problems. He teaches attorneys, CPAs and Enrolled Agents in the finer aspects of IRS representation all around the United States. He can be reached at his website at http://www.getIRShelp.com


2011年6月3日 星期五

Starting a Business - 5 Personal Inventory Audits to Help You Launch Your Business Startup


Starting a business appears to be as American as apple pie. Every year, tens of thousands of people in the United States decide to launch their own business start up. If you are thinking of doing the same thing, you probably need some help in deciding exactly what type of business you should start.

In over 9 years of being a business adviser and coach, I have helped numerous entrepreneurs make decisions like this with a special set of tools known as personal inventory audits. These personal inventory audits are simple sessions where you think specifically about a particular life area and create a list of assets. Here are 5 simple audits you can perform on yourself to help you decide on the business startup of your dreams.

1. Audit your Skills and Competencies

Starting a business related to skills you have means that you can be your own employee. These may be broader professional skills, or technical skills or even leadership skills. When you establish a company that delivers a skill set that you understand, you can manage your employees based on your first hand knowledge of what they do.

2. Audit your Experiences

The experiences you have been through in your personal or business life can form the foundation of a new company. Whether these are nominally negative or positive experiences does not matter. In seminars and workshops, I instruct people to "turn tears into gold" by repackaging their experiences (and lessons learned) for the marketplace of people who may be going through similar situations.

3. Audit Proximities

By proximities, I mean that you should audit and create a list of people, places, products, or philosophies that are near and dear to you. Ask yourself questions like:



What can I partner with these people to offer?
What do these people do well that I can sell?
What are the places I'm familiar with well known for?
What do I know about this product that many others need to know but do not?
How many others could use these philosophies I have been adhering to?

These types of questions serve to jog your thinking into action and to help you discover hidden opportunities for doing business.

4. Audit your Hobbies

If you have outdoor hobbies like extreme sports or hiking and mountain climbing, you can leverage your knowledge of these areas to start a related business. Not only could you start an equipment or accessory supply business, you could start an internet-based business where you sell valuable information to fellow hobbyists. The internet is also a great business platform if your hobby is an indoor activity like embroidery or scrapbooking.

5. Audit your Professional Knowledge

Do you have professional credentials? If so you could start a business in your area of expertise. An accounting professional I know recently started a bookkeeping business to help business owners in a very specific niche. This is a great way to leverage the work you have already done and the experience you have already built in your professional life.

Conclusion

Starting a business can be one of the most exciting but challenging experiences of your life. You can increase the chances of your business reaching the point of ultimate success that you define by building a business according to your core strengths. Learning to conduct regular personal audits gives you a great measure of control in your decision-making.

These personal inventory audits are not so much exercises in starting a business as they are tools for building self-knowledge.

Self-knowledge is something you will need to make sure that starting a business does not become something you deeply regret down the road. Whether you are in charge of a business startup or you are leading a corporate unit within an established company, gaining this kind of self-knowledge makes you a more effective leader - a more effective leader for your business organization, and a more fulfilled person in life.








Gogo Erekosima, is The Small Business Digital Coach and provides customized Denver Business Coaching through a unique system of identifying and deploying hidden personal and business assets. Sign up today for a Marketing SWOT Analysis. This consulting module uncovers strategic marketing and business growth opportunities. This Consulting Package is valued at over $1500 dollars.


How To Choose A Monologue For A Stage Audition


Just about any theatre audition will require actors to perform a monologue. Choosing the right monologue can be crucial in determining if you will be cast. Below are some important tips to remember when choosing your audition monologue.

Length: Remember, less is more. Many actors fall into the trap of choosing a 4-5 minute monologue. This only increases the chances of you loosing your audience. I recommend performing a monologue that's no more then a minute long. If the director needs to hear more, he/she will ask you to perform something else. The important thing to remember is to leave them wanting more!

Have several monologues prepared: Many times the director will wish to hear something else. This is why it's important to always have several monologues in your "back pocket" just in case. These should always be of different styles and genres. For example you should always have the following types of monologues prepared before you go to any audition: contemporary dramatic, contemporary comedic, classical dramatic, classical comedic.

Genre: This seems simple enough, but you would be surprised how many actors choose an inappropriate monologue for the play they're auditing for! It's simple, if you're auditing for a comedy, perform comedic monologue. The same goes if it's a drama. Also remember to follow the instructions in the audition notice. Many times it will state what the type of monologue should be performed.

Performing from the play: Unless it's specifically stated, you should NEVER perform a monologue from the play in which you're auditioning. If the director wants to hear you perform a piece from the play, he/she will call you back.

Self contained: The monologue should have a natural beginning, middle and end. It should be self contained so the director knows exactly who you're talking to, the conflict and resolution. Think if it as a mini-play. Also avoid monologues that require a lot of back story.

Conclusion

Keep in mind; above all else an audition is a performance. Strive to take the director on a "ride" with you. Make him/her see the character. Allow him/her to feel the conflict. If you do, you'll have many incredible acting opportunities in store for you!








For more information on how to improve your acting, please visit timsactingtips.com and sign up for my free weekly news letter that's filled with tips and advice that will help you become a better actor.


2011年6月2日 星期四

The Superstar Effect - Auditions & Confidence


How to Have Self Esteem? This question came to mind when I was reading a recent article in the Wall Street Journal (WSJ), called The Superstar Effect.

This article is based on the research of Jennifer Brown, an applied macro-economist at the Kellogg School of Management at Northwestern University whose research paper is titled, Quitters Never Win: The (Adverse) Incentive Effects of Competing with Superstars.

The main point of the piece (by Jonah Lehrer) is this: "While challenging competitions are supposed to bring out our best, these studies demonstrate that when people are forced to compete against a peer who seems far superior, they often don't rise to the challenge. Instead, they give up."

In her research, Brown used Tiger Woods and the world of golf as an example. She discovered that when Woods is playing well, other golfers who play against him in tournaments, do not play as well as they can. She has numerous statistics to back up her research.

Brown ends her paper by suggesting that her findings may have implications for students - "...there is a potential downside to introducing tournament-style incentives into a classroom setting with a "superstar" pupil. Indeed, my research suggests that one possible outcome of such an introduction is a reduction in the effort of other students..."

How To Have Self Esteem

While Brown is talking about the classroom, I think that we singers can learn a few things from this study, as well.

Imagine this! You are in an audition or a competition and the person who sings before you is an absolutely remarkable singer?

How do you feel?

Do you have the tendency to shrivel? To say to yourself, "Sheesh, why bother singing? Of course, s/he is going to win? What chance do I have?"

If this has happened to you, you are in good company. Remember the Tiger Woods example: the men who play against Woods are professionals who make quite a lot of money a year playing golf. They must train hard to be in that league. They must have won many tournaments in their careers. And yet even they can feel diminished by the perceived greater worth of another player.

So let's take a creative look at how to have self esteem in this situation with an instructive example from the world of chess...

To Compete Or Not To Compete? - That Is The Question

Here's a true story...

An average amateur chess player got paired against his first titled National Master in an important city-wide tournament.

His friend said "Boy, were you unlucky! If you were rated only a few points higher, you would have played an unrated, but instead you are playing the only master in Philadelphia!"

He was right. This was going to be one tough game.

However, that amateur won the game --- roughly a 50-1 long shot! He still uses this example today when telling players not to be afraid of their opponent and just try their best on each move.

He explains he was not playing the National Master. He only focused on finding the best move he could in the time available - (because serious, slow chess is played with a clock) - every time it was his turn to move.

How to Have Self Esteem in an Audition

So this chess player strategizes about moving pieces around on a board, while we singers "play" our bodies. How can we use this man's wisdom in the world of singing auditions/competitions? Here's one suggestion: Go to the audition with a unique state of mind.... Decide not to compete.

I mean it. Do Not Compete.

Tell yourself that you are not there to beat others. Instead you are there to present yourself in your best light. Step by step, follow through on all the things that you wanted to accomplish in the audition - from how you walk into the room, to how you complete your final phrase. If you attend carefully to all those performance details, you will be successful whether or not you "win."

And you will leave your best impression with the judges who will remember you next time, even if you do not take the prize this time.








If you would like to learn more about singing career tips please visit me at: http://www.singing-tips-with-barbara-lewis.com/index.html
I have been a singer, songwriter and vocal coach for over 25 years. I have produced and/or co-produced several of my own original-music CDs as well as two television-quality music videos which play regularly on Bravo TV and Classical Arts Showcase.


2011年6月1日 星期三

How to Audit Your Business Strategy


Why conduct a business strategy audit?

Nearly all the major initiatives undertaken by corporate executives today are called "strategic". With everything having high strategic importance, it is becoming increasingly difficult to distinguish between the many priorities and imperatives that are initiated in organisations. When everything is clearly strategic, often nothing strategic is clear. When everything is designated as a high priority, there are, in reality, no priorities at all.

However, when the overall strategic direction is clearly understood by everyone in your organisation, the following benefits occur:


organisational capabilities will be aligned to support the achievement of your strategy
resources will be allocated to different business processes in priority order - according to the importance of that process and its contribution to competitive advantage
your company or organisation can excel in the market place or in its business/commercial sector.

The purpose of a strategy audit is to arm managers with the tools, information, and commitment to evaluate the degree of advantage and focus provided by their current strategies. An audit produces the data needed to determine whether a change in strategy is necessary and exactly what changes should be made.

Defining a Strategy Audit

A strategy audit involves assessing the actual direction of a business and comparing that course to the direction required to succeed in a changing environment. A company's actual direction is the sum of what it does and does not do, how well the organisation is internally aligned to support the strategy, and how viable the strategy is when compared to external market, competitor and financial realities. These two categories, the internal assessment and the external or environmental assessment, make up the major elements of a strategy audit.

The outline that follows is derived from The Business Strategy Audit (see References). It's intended to give you a clear idea of how to set about conducting a self-assessment audit in your own organisation, without the need for any additional training or external consultancy support. But note that this outline does not include the range of Questionnaires and Checklists and the detailed guidance to be found in the full, 124-page Audit.

Part 1 ~ The External Environmental Assessment

A conventional corporate mission is to provide distinct products and services to customers at a value superior to that offered by competitors. Without a strategy, valuable resources will be diluted, the work of employees will be unfocused, and distinctiveness will not be achieved. The external environment assessment provides any business with a critical external link between its competitors, customers, and the products/services it offers.

The fundamental reason for examining an organisation's environment in the process of clarifying strategy can be summarised thus:


Ensure that the company is meeting the needs evident in the environment
Prevent others from meeting those needs in a better way
Create or identify ways to meet future or emerging needs.

The success or failure of a company often depends on its ability to monitor changes in the environment and meet the needs of its customers and prospective customers.

An organisation's business environment is never static. What is viewed as uniqueness or distinctiveness today will be viewed as commonplace tomorrow as new competitors enter the industry or change the environment by modifying the rules by which companies compete. Consequently, an effective strategy will do more than help a company to stay in the game. It will help it to establish new rules for the game that favour that company. Successful companies do more than simply understand their environments. They also influence and shape the circumstances around them. Companies that fail to influence their environments automatically concede the opportunity to do so to their competitors.

Steps in conducting an environmental assessment:

Step 1: Understand the external environment at a macro level

The first step in the environmental assessment is to develop a basic understanding of the trends and issues that will significantly change, influence, and affect the industry. The overall industry understanding comes from looking at the elements that influence the environment.

These elements include:


Capital markets
Industry capacity
Technological factors
Pressure from substitutes
Threat of new entrants
Economic factors
Political factors
Regulatory factors
Geographic factors
Social factors

A useful framework to understand these issues comes from answering the following questions. They should be posed directly when used in an interview, and indirectly when analysing data:


What is the long-term viability of the industry as a whole, and how do capital markets react to new developments?
What trends could change the rules of the game?
Who are the industry leaders? What are they doing? Why?
What are the key success factors in the industry?
What developments could allow a company to change the rules of the game?
Five years from now, how will winners in the industry look and act?
What is the reward (and/or cost) of being a winner/loser within the industry?
Where has the industry come from?

Step 2: Understand the industry/sector components in detail

Industry/sector components are normally broken down as follows: competitors, customers and stakeholders. Questions that should normally be asked of each key competitor include:

BUSINESS REVIEW

Strategy Issues:


What is the strategy of each competitor? Where do they appear to be heading?
What is their business emphasis?
Do they compete on quality, cost, speed or service?
Are they niche or global players?

Capabilities:


What do they do better than anyone else?
Where are they weaker than others?
Where are they the same as others?

Business Objectives:


Who are their primary customers?
What types of business do they not do or say no to?
Who are their major partners? Why are they partnering? What do they gain from it?
What are they doing that is new or interesting?

FINANCIAL REVIEW

Financial Strength - Internal:


How much cash does each competitor generate annually?
What are the drivers behind their financial success (from a cash perspective)?
How do they allocate resources (funds)?
How fast are they growing and in what areas?

Strength as Perceived by Capital Markets:


Are competitors resource constrained or do they have strong financial backing?
Is this perception consistent with the internal analysis? Why or why not?
How has the company performed in the financial markets? Why?
What constraints/opportunities do they have with respect to financial markets? Why?

ORGANISATION REVIEW

Top Management:


Has management kept the company at the forefront of the industry? Why or why not?
Are the key players seen to be moving the company forward?

Organisation:


Is the company centralised or decentralised?
Does the corporate parent act as a holding company or as an active manager?
Is the organisation perceived as being lean and able to get things done?

People:


How many people are employed? Is the company over-or under-staffed?
Are people managed to achieve mainly business objectives, human objectives or some of both? How does this affect the company?
What skills are emphasised during recruitment?

Culture:


Is the culture results-oriented?
Bureaucratic?
Flexible?

Similar lists of questions should be developed for customers and stakeholders (or see the full Audit for ready-made questionnaires).

Step 3: Integrate the components into an environmental picture

Once the findings of the stakeholder analysis, customer analysis and competitor analysis (above) have been collected, audit team members should step back and integrate the data. Integrating the different components will help the team to understand the overall environment in which the business operates.

This integration should take place at two levels: assessing where the industry is heading and the likely impact of that direction on the company, and combining the organisational assessment with the environmental assessment.

The Business Strategy Audit offers a detailed framework for analysing this data. In brief, it should highlight significant changes in the environment, and the impact of those changes on the company's competitive position within the industry. It should address the fundamental question of how the company can influence its environment in the future, and what the business will need to look like if it is to thrive in the future.

In addition, the analysis should highlight the requirements and capabilities that are needed within the company to meet external demands. These requirements and needs should then be matched up with the current capabilities outlined in the organisation assessment. This will enable the team to determine the overall alignment of the company's strategy to its environment.

Part 2 ~ The Organisational Assessment

Once the company's environment has been examined and analyzed, managers should consider the qualities and characteristics of the organisation itself that influence what can be accomplished in terms of strategy. This section is about organisational assessment. The steps shown here will provide insights into the effectiveness of the company's current strategy, and provide guidelines for increasing strategic effectiveness.



Strategy Clarification. Strategy clarification helps the leadership team determine what business they are in, the direction of the business, and framework or criteria for making strategic decisions in the future. If people at any level of a business are unclear about any of these three areas, it is difficult for them to focus their attention, cooperate with other teams, and organise their efforts to gain competitive advantage in the marketplace.

Viability and Robustness. Measuring viability and robustness helps a leadership team test strategies and ideas against future world scenarios to determine whether the strategies can be achieved and sustained. By looking at both market and financial viability and robustness in different scenarios, a management team can see what will create advantage in the future and what key measures need to be implemented to monitor changes in business conditions.

Business Processes. The term business process refers to the overall work flow within a company and includes elements such as product design, manufacturing, and delivery. A good process analysis will help a leadership team to see what must be done given the company's strategy, and how those processes can be improved.

Capabilities. Capabilities are bundles of separate skills required to deliver the products or services that give a business competitive advantage. There are two parts of a capability assessment. First, the capabilities needed to execute the strategy must be determined. Second, the current level of ability in terms of those capabilities must be assessed. Without knowing what capabilities should be focused on and improved, competitive advantage will be difficult to achieve.

Organisation Design and Resourcing. This part of the analysis looks at alignment issues between the environment, the strategy, the skills required to achieve that strategy, and the organisation structure. During this step, a management team can design an organisation that aligns systems in a way that will allow them to execute a strategy. Unless the systems within a business are aligned to improve effectiveness or efficiency, strategy statements are merely plaques on the wall that are seldom realised.

Culture. Culture refers to the set of shared values that influence behaviour and direction over time. The style of management and the beliefs and assumptions commonly held by people in the organisation must be determined in order to ensure alignment and execution of the strategy.

Having completed each of these assessments, they must be integrated by the audit team. In this process, audit team members should attempt to answer one fundamental question: Is our strategy in alignment with the external environment?

To answer this broad question, the following issues should be addressed:


Do our capabilities match our customer requirements?
Do we offer something required by our customers that is better than the offerings of our competitors?
How are customer demands changing?
How are competitors changing?
How are our internal capabilities evolving to keep pace with those changes?

Depending on the answers to these questions, the team can implement the changes dictated by the audit. In making these changes, three issues should be considered:

Structure follows strategy - This means that current organisational boundaries and structures should not be allowed to determine the selection of a competitive strategy. Rather, the environmental and organisational assessments that you have just conducted should determine and drive strategy selection.

Plans for change must be widely owned - Those people ultimately responsible for implementing strategy (typically front-line employees) should be consulted for their ideas about what changes should be made and how they should be made. Otherwise, very little change is likely to happen.

Implementation should start with what is core to gaining advantage - In other words, start with core business processes, 'pick the low hanging fruit' first, make those changes that will make the most visible difference.

In addition, it may be useful to know that the following are the most common mistakes made by teams conducting business strategy audits:


Expecting all data to be equally useful
Do nothing with the audit findings
Failing to link other support systems (rewards, administration, etc.) to strategy
Not thinking strategically about what processes and capabilities to keep in-house and what to outsource
Failing to prioritise those core processes that must be world-class
Failing to match internal capabilities with customer requirements
Failing to communicate audit findings and strategy changes to people throughout the organisation is a clear and simple language








Andrew Carey is editor of the full-length Business Strategy Audit referred to in this article. It is published by Cambridge Strategy Publications (http://cambridgestrategy.com). Andrew has worked as a writer, editor, marketing consultant, publisher, team facilitator and business development adviser. He is also a practising psychotherapist.


The Evolution of HR Audits


Evolution is a process of change. Over the last 25 years we have seen significant change in the HR auditing process, the value derived from HR auditing, and the HR audit tools used. HR audits have evolved from a simple checklist of dos and don'ts or periodic affirmative action plans to a comprehensive, sustainable process that:

1) is an integral part of the organization's internal controls, due diligence, and risk management;

2) is a fundamental activity of strategic management; and

3) uses sophisticated auditing products and consulting services. Increasingly HR audits are conducted of HR rather than by HR.

This white paper reviews the changes in HR audits, discusses the external and internal forces affecting the process and use of HR audits, and provides information about the leading HR auditing process.

Overview of HR Audits

The HR auditing process is or should be an independent, objective, and systematic evaluation that provides assurance that:

1) compliance and governance requirements are being met;

2) business and talent management objectives are being achieved;

3) human resource management risks are fully identified, assessed, and managed; and

4) the organization's human capital adds value.

Under this definition, HR audits are more than an audit activity that solely collects and presents evidence of compliance. HR audits are increasingly expected to look behind and beyond the organization's assertions of sound and proper HR management practices and to assess the assumptions being made, to benchmark the organization's processes and practices, and to provide the necessary consultative services that help the organization achieve its business goals and objectives.

External and Internal Forces

Numerous external forces and factors have had an impact on the demand for and scope of HR audits. First, in the global economy, human capital is becoming the single most important determinant of competitiveness, productivity, sustainability, and profitability. Increasingly, the organization's human capital is being recognized as the source of innovation and a driver of business success. Thus to be effective in the global economy, HR audits must be diagnostic, predictive, and action oriented.

Second, a confluence of economic, political, and social factors, including corporate scandals, the failure of the financial industry to adequately assess risks, and increasing stockholder initiatives, have resulted in increased statutory and regulatory requirements, a call for greater transparency, and increased internal and external audit activity. Consider:

1) Sarbanes-Oxley requires effective internal controls. While Sarbanes-Oxley specifically requires effective internal financial controls, the financial and organizational costs of employment related claims and litigation can have a material effect on an organization's bottom line; can have a negative impact on earnings per share and the organization's valuation; and because employment litigation can negatively affects the organization's employment brand, can impact the organization's long-term sustainability.

2) Securities and Exchange Commission Guidelines require management to "...exercise reasonable management oversight." If human capital is one of the organization's most important assets it is certainly one of the organization's largest expenses is it not reasonable to expect that management applies the same level of oversight and due diligence to the management of the organization's human capital as it does to the management of the organization's other assets.

3) The U.S. Federal Sentencing Guidelines require that management demonstrate that it took reasonable steps to engender an organizational culture of compliance and to "monitor and audit" compliance activities, behaviors, and results. Ethical conduct and legal compliance, including nondiscriminatory employment practices, are achieved by management setting "the tone at the top." Audits including HR audits provide the C-suite and boards of directors with important feedback about how effectively they are communicating the message.

4) Governmental agencies are attacking systemic noncompliance. The EEOC strongly encourages employers to conduct comprehensive HR audits as a tool to ensure that systemic discrimination does not exist. The OFCCP considers self-assessments a "best practice' and in June 2006 issued its final voluntary guidelines for self-evaluation of compensation practices. The U.S. DOL considers wage and hour self-audits as a valuable tool in ensuring compliance, and the Department of Homeland Security (DHS) and immigration attorneys encourage employers to self-audit their I-9s and hiring processes and practices to ensure compliance with U.S. immigration laws.

5) Venture capitalists, investors, and stockholders are scrutinizing organizations' human resource management practices, processes, and outcomes and using HR audits to help them properly valuate an organization's human capital asset, expose liabilities, and perform due diligence.

6) Recognizing the importance of the organization's human capital asset and the risks associated with misaligned, mismanaged, and unlawful employment practices, internal auditors and risk managers are assuming a leadership role in developing HR auditing standards and in designing and conducting HR audits.

Designing and Conducting HR Audits

While an organization's size, industry, financial health, commitment to becoming a "best place to work," and business objectives and imperatives affect the scope and urgency of the HR audit process, we have noted some common features, attributes, and objectives in HR audits recently conducted.

1) HR audits are becoming increasingly complex and multi-dimensional. While ensuring compliance is still a basic goal of HR audits, other objectives include:

A. Ensuring alignment of HR management and employment practices with the organization's business objectives.

B. Assessing the outcomes of the organization's employment processes, policies, practices, and outcomes.

C. Developing the right human capital measurements and HR metrics to allow the organization to calculate and measure the value added by human resources, to determine the ROI and the return on the human capital asset, to measure the outcomes of employment policies and practices and the achievement of EEO and diversity goals, and to benchmark best practices.

D. Ensuring due diligence, including: uncovering hidden liabilities and assets, identifying vulnerabilities to be corrected, and identifying opportunities to be attacked.

E. Developing HR auditing procedures that become an ongoing and sustainable element of the organization's internal controls.

F. Assessing and managing employment related fraud.

G. Developing HR auditing procedures that become an ongoing and sustainable element of the organization's risk management program.

2) HR audit reports are increasingly being used to report audit findings to wider audience. The distribution of the report on auditing findings is no longer limited to senior management. As noted above, an increasing number of third parties are expressing interest in the organization's human resources management. This list of external stakeholders includes not only investors, major stockholders, and venture capitalists, but also governmental agencies, NGO's, civil rights groups, and plaintiff attorneys. Since HR audits findings include proprietary and confidential information and in many cases produce discoverable information, the implications of non-management stakeholders reviewing HR audit finding are significant and create a potentially serious problem for organizations. As a result, organizations are spending more time considering the format, content, and the impressions created by their HR audit reports.

The Five Critical Components of the HR Audit Process

Recognized as setting the standard in HR auditing, the new edition of the ELLA?, the Employment-Labor Law Audit?, the leading HR auditing tool, incorporates the five critical components of an HR audit into the HR audit process. These five critical components, which should be addressed in every HR audit, are shown and discussed below in the HR Audit Model?.

1) Activities: The starting point of the HR auditing process is a review of the organization's activities, that is, the tasks and actions that create or implement employment policies, practices, procedures, and programs. Activities include such actions as the promulgation of an EEO policy statement and other employment policies, and the posting of required employment posters. The Activities component of HR audits is typically evaluated by using a "checklist approach," that is, the item is checked off when it is completed.

2) Behaviors: Behaviors in this context are actions and conduct that affect either positively or negatively the implementation or effectiveness of the organization's policies, practices, procedures, and programs, and demonstrate the organization's commitment to stated goals and objectives. Examples of Behaviors include: the creation of a corporate culture that values and promotes equal employment opportunities, diversity, and compliance; the visible and unequivocal support by senior management for the organization's diversity efforts; and the budgeting of sufficient resources to achieve EEO compliance and diversity goals. Behaviors are frequently assessed using qualitative measures, such as culture scan and employee satisfaction surveys.

3) Risk Assessment: Risk assessment is the identification of current and/or future events that have the potential to cause loss, peril, or vulnerabilities, and management's willingness to accept those risks. Risk assessment is also the identification of events or conditions that create new opportunities for the organization to achieve its business objectives. Risk assessment provides management with the information to make informed decision about the allocation of the organization's human, physical, and financial capital and about effective ways to eliminate, mitigate, control, or transfer those risks. Human resource management and employment practices liability related risks include: employment law and regulation compliance failures; lost business opportunities due to the failure to attract, hire, and retain top talent; intangible asset losses due to turnover and the loss of top talent and key employees; ineffective staff development and succession planning; and lower profitability due to the inability to control labor costs. HR auditing activities include assessments of the external and internal factors that impact human resource management and employment practices - including:

1) the economy;

2) legal, regulatory, and litigation trends; and

3) demographic and structural changes in the workplace and work force.

4) Internal Controls: Internal controls are processes, tests, and assessments that help ensure compliance, manage risks, identify fraud, and help ensure the achievement of organizational goals. HR auditing activities include:

1) assessments of the effectiveness and efficiency of HR management processes, policies, practices, and procedures;

2) the reliability and accuracy of HR management reporting; and

3) the level of compliance with: laws and regulations; industry and professional standards; codes of conduct and ethics; organizational policies; and budgets.

5) Outcomes: Outcomes are quantitative and qualitative measurements and metrics that measure and help assess the achievement of organizational goals and objectives. HR auditing activity includes the identification of metrics used by the organization to measure organizational and individual performance; the assessment of results by comparing actual results against projected results, budgets, and internal and external standards; and a description of the activities, behaviors, and internal controls that are needed to maintain or improve future results.

The value of the HR Audit Model? is that it helps organizations:

1) assess current HR management and employment practices;

2) identify and diagnosis systemic problems;

3) evaluate and predict the impact of corrective measures;

4) develop a plan of action; and

5) determine the ROI of such actions.

Using the ELLA?, organizations enhance the value of their human capital, reduce their exposure to employment related liabilities, and improve their ability to achieve business objectives.








Ronald Adler is president-CEO of Laurdan Associates, Inc. an HR management consulting firm specializing in HR audits, employment practices liability risk management, HR internal controls, HR metrics, strategic HR, employee surveys, and unemployment insurance cost management. Mr. Adler is an adjunct professor at Villanova University where he teaches a graduate course in HR audits.

Laurdan Associates is the developer of the Employment-Labor Law Audit (ELLA), the leading HR auditing and employment practices liability risk assessment tool. For more information or a free trial use of ELLA contact Ronald Adler at 301-299-4117, radler@laurdan.com, http://www.laurdan.com