Defining a Process for Gathering Information Pertaining to a GLBA Compliance Audit

Introduction 
A financial institution is like any other business in that it aims to maintain or raise its profits.  It is safe to assume that some financial institutions—faced with the choice between safeguarding an individual’s information and safeguarding the institution’s overhead costs—would lean toward lowering costs. Once the Gramm-Leach-Bliley Act (GLBA) was enacted in 1999, such choices were no longer an option. Available online are several cases of documented abuse of customer trust that predate GLBA. On http://epic.org/privacy/glba  are cases such as a bank that sold a list of its customers’ credit card numbers to an adult Web site, which fraudulently invoiced the bank’s clients for online “services they did not request.”  Those invoiced included customers with no online access.  In another case, a bank shared customer information with a subsidiary. The subsidiary preyed on low-risk customers to purchase high-risk investments, resulting in massive losses. Still, other cases describe banks sharing customer information with telemarketing firms.
Once GLBA was enacted, including Title V detailing the protection of financial information, banks have since faced strict limitations on information sharing without the customer’s knowledge and consent. Protecting nonpublic information is a requirement of GLBA compliance. In this homework assignment, you will identify the Gramm-Leach-Bliley Act (GLBA) requirements for implementing the administrative, technical, and physical controls necessary to protect nonpublic personal information; you will define what financial information and personal information are impacted by the Privacy and Safeguards rules of GLBA; you will assess the requirements for handling nonpublic personal information and comprehend the GLBA guidelines regarding the proper security for this data; and you will investigate how GLBA has impacted controls to protect nonpublic personal information and financial information.

Learning Objectives 
Upon completing this homework assignment, you will be able to:

GLBA’s Scope: It’s critical to understand GLBA’s reach. The rules and protections granted to the individual by GLBA define the auditor’s scope. Only by understanding the GLBA can the auditor align the audit goals and objectives within a defined scope.

When GLBA Applies: In the most general sense, if the financial activity is between any individual and a financial institution (such as a bank, brokerage house, or any company that offers a financial service or product), then GLBA applies.

An Audit’s Key Points: When auditing an organization, remember that an audit means you’re checking compliance against a known, expected environment. Therefore, at the bare minimum, the auditor should review the organization’s written policies. Other key elements for the auditor to review include system documentation, procedures, vendor agreements, and network documentation. If any prior audits were performed, those reports would be very helpful. In short, any documentation to better understand the organization and how it conducts business is helpful to the auditor.

Overview
In this homework assignment, you identified the Gramm-Leach-Bliley Act (GLBA) requirements for implementing the administrative, technical, and physical controls necessary to protect nonpublic personal information; you defined what financial information and personal information are impacted by the Privacy and Safeguards rules of GLBA; you assessed the requirements for handling nonpublic personal information and comprehended the GLBA guidelines regarding the proper security for this data; and you investigated how GLBA has impacted controls to protect nonpublic personal information and financial information.