Andrae Marsh Email & Phone Number

•As part of an official subcommittee, initiated by the International Organization for Standardization, assists in the overall development, authoring implementation and assessment of ISO 27001 &27002 standards, amongst others.

• Review and assess the adequacy of IT Security policies and procedures, controls and the execution of testing to determine compliance;• Acted as the most senior IT Auditor in the software license and entitlement compliance, that was executed against the Caribbean's largest Commercial bank- IBM. • Provided guidance and recommendations for the Network Security architecture and design for the implementation of IBM's monitoring tool, in the Caribbean's largest Commercial bank.• Execution and reporting of Network Vulnerability/security assessments; • Plan, scope, execute and manage various IT Audits and Security reviews, in the Financial, Utilities Investment and Manufacturing sectors. • Performed IT Disaster Recovery reviews to assess organizations’ recovery and contingency efforts in technical preparations for possible disruptions, disasters or outages, for Commercial banks and Investment entities.• Managed vendor selection and hand holding processes for various Banking and manufacturing clients• Executed enterprise wide IT Risk assessments with the major aim being to reduce the overall exposure to technology risk and drive the direction and effort of future assessments. • Performed consultative reviews in which, enterprises' Security Architectures were evaluated and subsequent recommendations, road maps and processes were recommended and further evaluated after implementation.• Provided coaching to junior staff in order to relate engagement goals, expectations and subsequently provided documented feedback, throughout engagements.• Managed Engagement Economics against desired realisation including negotiations with clients for changed billing terms, scope, right offs and final billing.• Plan, lead, manage and review work products during IT General Control reviews, technical security reviews and assessments for enterprise networks, Financial applications, databases and other enterprise platforms, etc against PCI, ISO, SANS and other applicable standards.

• Designed, tested and oversaw the implementation of the security, privacy and access control (aligned with ISO 27002 controls)for SPA client data and propriety tools, In a local PwC office.• Performed ITGC reviews and assessed the IT environments for the Organization’s External Audit clients, to determine the extent to which their technology controls could be relied on, in the mitigation of fraud and financial statement assertions-SOX assessment.• Designed, tested and oversaw the implementation of the security, privacy and access control for SPA client data and propriety tools, In a local PwC office.• Conducted data analysis and application reviews in order to investigate possible instances of fraud.• Utilized the Audit Control Language (ACL) in the interrogation and assessment of financial data, for Journal Entry testing and validation purposes• Identified, understood and subsequently assessed the effectiveness of Application controls in the following platforms: JDE, Accpac, PeopleSoft and Oracle E-Business suite (Financials).• Performed informal training for peers and the Senior Manager in the use of the ACL suite.

• Acted as a senior team member the Gap analysis and review of Information Systems Management aligned with ISO for a major investment organization. • Assessed the IT environments for the Organization’s External Audit clients, to determine the extent to which their technology controls could be relied on, in the mitigation of fraud and financial statement assertions-SOX based methodologies.• Performed IT Disaster Recovery reviews to assess organizations’ recovery and contingency efforts in preparations for possible disruptions, disasters or outages, for Commercial banks, Financial companies, Law firms and Investment entities.• Performed IT Governance and Strategy assessments using a combination of E&Y's propriety methodology, Cobit and ITIL frameworks. • Planned, scoped, executed and supervised staff in Network Security assessments for organizations in the Banking and Financial industries.• Planned, scoped, executed and supervised staff in various IT and internal audit advisory engagements, in the Financial, Telecommunications, Government, Utilities and Manufacturing sectors.• Identified, understood and subsequently assessed the effectiveness of Application controls in the following platforms: JDE, Accpac, PeopleSoft and Oracle E-Business suite (Financials)• Responded to various proposals in order to win engagements requiring IT security, IT Audit, Network Security, Network Penetration testing, Application control reviews, and BCDR solutions. • Conducted data analysis and application reviews in order to investigate possible instances of fraud using the ACL suite.•Develop consulting engagement’s project scope, budget and the specific procedures to meet objectives for projects in the Financial, Telecommunications, Government, Utilities and Manufacturing sectors. Seek to develop and present ideas to apply appropriate best practice to bring added value to audits.