1. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV MetricStream GRC Summit 2013: Product Showcase ENGAGE | INSPIRE | TRANSFORM → W E L C O M E

2. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV ENGAGE | INSPIRE | TRANSFORM Aneesh Bhatnagar Associate Director – Product Policy and Compliance Management Aneesh Bhatnagar Policy & Compliance Management

3. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Agenda 1.Policy Management 2.Compliance Management

4. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Policy Management

5. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Topics 1.Policy Management 2.Product Overview: Key Features 3.Policy Development 4.Policy Maintenance 5.Policy Communication 6.Policy Implementation & Enforcement 7.Reports / Dashboards

6. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM GRC

7. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM G RC Policy Management helps set the principles/ rules to guide decisions (set the governance objective & procedures) to achieve compliance on these objectives

8. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Policy Management Determine the Need Develop & Maintain Communicate Implement & Enforce

9. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Key features of Policy Management 1.Ability to create Inline as well as Document based policies

10. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Key features of Policy Management 1.Ability to create Inline as well as Document based policies 2.Ability to link policies/sections to relevant GRCF objects

11. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Key features of Policy Management 1.Ability to create Inline as well as Document based policies 2.Ability to link policies/sections to relevant GRCF objects 3.User Configurable workflows

12. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Key features of Policy Management 1.Ability to create Inline as well as Document based policies 2.Ability to link policies/sections to relevant GRCF objects 3.User Configurable workflows 4.Audit Trails

13. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Key features of Policy Management 1.Ability to create Inline as well as Document based policies 2.Ability to link policies/sections to relevant GRCF objects 3.User Configurable workflows 4.Audit Trails 5.Powerful Policy Search

14. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Key features of Policy Management 1.Ability to create Inline as well as Document based policies 2.Ability to link policies/sections to relevant GRCF objects 3.User Configurable workflows 4.Audit Trails 5.Powerful Policy Search 6.Granular Access Controls

15. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Key features of Policy Management 1.Ability to create Inline as well as Document based policies 2.Ability to link policies/sections to relevant GRCF objects 3.User Configurable workflows 4.Audit Trails 5.Powerful Policy Search 6.Granular Access Controls 7.Supports for policy management lifecycle

16. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Key features of Policy Management 1.Ability to create Inline as well as Document based policies 2.Ability to link policies/sections to relevant GRCF objects 3.User Configurable workflows 4.Audit Trails 5.Powerful Policy Search 6.Granular Access Controls 7.Supports for policy management lifecycle 8.Ability to control the number of copies that can be printed

17. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Key features of Policy Management 1.Ability to create Inline as well as Document based policies 2.Ability to link policies/sections to relevant GRCF objects 3.User Configurable workflows 4.Audit Trails 5.Powerful Policy Search 6.Granular Access Controls 7.Supports for policy management lifecycle 8.Ability to control the number of copies that can be printed 9.Automatic conversion of the final policies into PDF along with the header, footer, e-signature & document information

18. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Key features of Policy Management 1.Ability to create Inline as well as Document based policies 2.Ability to link policies/sections to relevant GRCF objects 3.User Configurable workflows 4.Audit Trails 5.Powerful Policy Search 6.Granular Access Controls 7.Supports for policy management lifecycle 8.Ability to control the number of copies that can be printed 9.Automatic conversion of the final policies into PDF along with the header, footer, e-signature & document information 10.Sophisticated dashboards to monitor the policy management

19. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Key features of Policy Management 1.Ability to create Inline as well as Document based policies 2.Ability to link policies/sections to relevant GRCF objects 3.User Configurable workflows 4.Audit Trails 5.Powerful Policy Search 6.Granular Access Controls 7.Supports for policy management lifecycle 8.Ability to control the number of copies that can be printed 9.Automatic conversion of the final policies into PDF along with the header, footer, e-signature & document information 10.Sophisticated dashboards to monitor the policy management 11.MLS enabled

20. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Create Document based policies Any user defined in the first stage (i.e. the author stage) of the lifecycle can initiate a policy creation process Select the lifecycle and the category/ sub-categories Modify the stage level users. Upload the controlled policy document

21. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Map it to other GRC Content The author / reviewers can relate a policy with GRCF Objects to set the Policy / Procedures for one or many GRCF Objects

22. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Review / Approve Document based policy The Reviewers can access the Policy using the View, Download, Print, Upload Privileges Reviewers can select the reviewers of the next stage based on the appropriate privileges Can have ‘n’ number of stages based on how the lifecycle is setup

23. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Create Inline Policy Create a policy in sections. Each section can relate to a GRCF object All the sections will be exported to Word and the Policy Users will get a complete view of the policy The author can choose to send the section to a reviewer / approver

24. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Review & Approve Inline Policy Each approver / reviewer will be shown the section that he needs to approve He can choose to approve or reject a section Once all the sections are approved / reviewed, the policy will get published.

25. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Policy Maintenance Major Change - When an existing policy needs to be changed significantly Minor Change - When an existing policy needs to be undergo a small modification Policy Obsoletion - When an existing policy goes out-of-date

26. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Policy Maintenance : Upversion Option to change the lifecycle while upversioning the policy

27. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Policy Maintenance : Change Request Select the Option Change Request. The policy routes through all the stages of the lifecycles and once published will be available to the end users

28. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Policy Maintenance : Change Request Policies can be obsoleted by initiating the policy Obsoletion process Obsoleted policies are not available to the end users

29. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Policy Communication After a policy is published, the policy can be sent out for Policy Communication. All the policy users of that specific policy will receive an email notification with the link to provide their feedback. The policy users can access the Policy and can either accept or reject the policies The acceptance or rejection of the policy is retained in the system and can be produce as an evidence

30. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Policy Attestation The Policy users can either accept a policy or Request for exception and provide their comments The attestation information provided by the policy users are available in the policy management reports

31. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Policy Discovery Policy discovery can be done in two ways Browse – In a windows explorer like tree view Search – Using the search filters

32. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Reports In-process Policy Documents Report Approved Policy Documents Report Obsolete Policy Documents Report Audit History Report Policy Management Reports

33. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Audit History

34. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Dashboards Dashboards for Policies in the lifecycle Published Policies Policy Access Policy Attestations Provides drill down from each of the dashboards to list additional information like the number of people who have not attested, who have already attested etc. with an option to export these details

35. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Multi Lingual Support

36. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Multi Lingual Support

37. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Regulatory Changes

38. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM GRC Intelligence

39. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM GRC Intelligence

40. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Compliance Management

41. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Compliance Management Policies Regulations AOC Controls Processes Standards Objectives

42. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Compliance Management Policies Regulations AOC Controls Processes Standards Objectives Functions Assets Questions/ Procedure Evidences Exceptions Financial Account Assertions Auditable Entity

43. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM ONE F L E X I B L E DATA MODEL

44. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Flexible Model that helps test NOT just Controls

45. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Leverages Harmonized Content from GRC Library

46. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM GRC Library linked to your Policies

47. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Supports correlation between Controls and Question

48. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Integrated with Issue and Action Tracking System

49. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Create Adhoc Tests

50. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM View Prior Test Results while performing Tests

51. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Calendar to view Task Schedule

52. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Upload Test Plans

53. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM 1.Flexible model that helps test not just Controls 2.Leverages Harmonized Content from GRC Library 3.GRC Library linked to your Policies 4.Supports correlation between controls and questions 5.Integrated with Issue and Action Tracking System 6.Easily create ad-hoc tests and assign to individuals (without creating a full-blown plan) 7.Provides access to prior assessment data while doing the assessment. 8.Calendar to view Tests, Surveys & Certifications 9.Upload Test Plans 10.Out of the Box Reports & Dashboards Summary

54. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM The Year 2012 What we did

55. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM 2012… 1.Advanced Testing Framework Enhances planning and scheduling Enables proactive detection of non-compliance Sends Surveys and Certifications to Users, Roles, Control and Process Owners 2.Regulatory Compliance Dashboard Allows the compliance manager to track control failures and sample failures for every Area of Compliance, Type of Area of Compliance and at an Organization level 3.New Reports Failed Test Report Not Tested Report Line Items with key controls with no Test Plan Compliance Status by Organization 4.Data Upload 5.Multi lingual support

56. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Regulatory Compliance Dashboard

57. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM SOX Dashboard

58. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM SOX Report

59. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM SOX Score Card Total # Of Controls Controls Tested / Not Tested Controls Missing Test Plans Controls Failed / Passed Overdue Tests Issues – Open, Overdue, Closed Total # Of Controls Controls Tested / Not Tested Controls Missing Test Plans Controls Failed / Passed Overdue Tests Issues – Open, Overdue, Closed

60. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM The Road Ahead 2013

61. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM The Road Ahead – 2013… 1.Create Requirements from Policy 2.Support for Testing Control Objectives and Standards 3.Test Controls and Process related to Objectives, Standards, Regulations, AOC, Policy etc 4.Integration with PDMS and Surveys Module 5.Link Evidences and Exceptions during Tests 6.Automated Sample Size Calculation 7.SOX Scoping 8.Simplified Self Assessment 9.Mass Reassignment 10.Automated Issue Creation for Failed Tests 11.Remediation Testing 12.Validation Testing 13.Enhanced Reporting and Dashboards

62. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Test Standard & Objectives

63. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Add Exceptions to Test

64. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Attach or Link Evidences

65. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM View Exceptions and Evidences

66. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM Test Status Report

67. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM The Vision 2014 and Beyond

68. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM The Vision – 2014 and Beyond… 1.Roll over Tests 2.Test Compliance of Products, Projects etc 3.Mind Map Style Visualization of Controls and its connections 4.Simplified Control Testing User Interface 5.Continuous Control Monitoring

69. GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV © MetricStream, Inc. |All Rights Reserved ENGAGE | INSPIRE | TRANSFORM GRC SUMMIT 2013 Apr 30 - May 1, 2013 | Mandarin Oriental, Las Vegas, NV Q u e s t i o n s a n d D i s c u s s i o n ENGAGE | INSPIRE | TRANSFORM [ Presenter Name ] [ Presenter’s Contact Email ID ]