# Presentation: 429005

## Engineering 

***Engineering ***
***Connections/Reflections***
*** ******Opportunities***

**Kimberly Gavaletz, Vice President**
**Lockheed Martin**
**Corporate Internal Audit**
**November 2004**

## Agenda

**Agenda**

***  ******Introductions***
*** ******Connections – Engineering and Audit***
*** ******Reflections - Lessons Learned***
-  ***Opportunities ***

## The People of Lockheed Martin

***130,000 Employees***
***55,000 Scientists and Engineers***
***30,000 Software and Systems Engineers***
***6 CMMI Level-5 and Level-4 Companies***
***Operations in 45 States and 56 Countries***

***We Never Forget Who We’re Working For TM***

## Responsibility

**Produce**
**Technical**
** ****Results**

**Provide**
**“****Positive”**
** **
**Financial Returns**

## Objectives
Risks
Controls
Monitoring
Assessment

***Risks***
***Controls***
***Monitoring***
***Assessment***

**The Challenge**

## Connections - Engineering  Sources

***LM21 (Lean and Six Sigma Initiatives)***
***Program Management Council, EV Council, Engineering Process Improvement Council...***
***Program or Company:  Product Assurance, Quality,  Process Integrity Organizations***
***Independent External Assessment and Certification  Functions (ISO, SEI, EV, VPP, Consultants)***
***Internal Processes - ICE, IBR, PAR, NAR, SAR***
***Audit (Observed Areas of Excellence, Compliance, Programs, I/T & Advisory)***

##  Internal Audit’s Responsibility 

*** ******Evaluate***
***Risk Management***
***Internal Controls***
***Governance***
*** ******Provide Early Warning***

*** ******Proactive Support***
*** ******Transfer Best Practices***
*** ******Improve Performance***

**PROTECT**

**IMPROVE**

## Leverage Resources

**Strategy & Planning**
**Shelly Paup**

**Audit Operations**
**Brad Owens**

**Audit Services**
**Reggie Combs**

**Corporate Internal Audit**
**Kimberly Gavaletz**** **

-  Audit Plan Completion
-  Governance
-  Execution
-  Information Technology

-  Advisory Services
-  BLDP
-  Tools

-  Audit Plan
-  Audit Council

**Leverage Resources**
**Across LM**

**Optimize Audit**
**Engagements**

**Enhance Quality**

**Audit & Ethics               **
**  ****Committee**

**Business Area **
_**Points of Contact**_
** ****Corporate                              Kimberly Gavaletz**
** ****Space Systems                     Brad Owens**
**  ****IS&S                                      Brad Owens**
**  ****Aeronautics                         Shelly Paup**
**  ****Electronic Systems             Reggie Combs**
**  ****I&TS                                      Shelly Paup**

**President and CEO**

## Corporate Internal Audit

**Corporate Internal Audit**

**Palmdale**

**Albuquerque**
***(DOE)***

**Denver**

**Sunnyvale**

**Marietta**

**Valley Forge**

**Chelmsford**

**Bethesda**

**Orlando**

**Ft. Worth**

**Scottsdale**

***Personnel Locations***

_***Operations Concept***_
***                                                   ***
***   ******Personnel Reside in the Field... ***
***      ***_***Projects Staffed Based on Skills***_
***  ******Standardized Audit Program ***
***     ******(Tailored  as Needed)***
***  ******Travel to Location for Fieldwork... ***_*** ***_

**	****                **_***Staff Profile ***_
***100 %******	******Bachelor Degree***
***  ******26 %******	******Masters Degree***
***  ******14 Yrs   Avg. Business Experience***
***    ******6 Yrs   Avg. Internal Audit Experience***
***  ******48 %******	******Certified -- 25 Different Certifications***

**Notes:**
As this chart displays, we have 12 audit offices across the country.  There are 3 offices at DOE locations, 8 at major operating units of the corporation, and 1 at the Corporate Headquarters.

## Mission Success  –  Audit Plan Execution 

_**Resolution**_

_**Engagement**_

**  ****Closure Process**

**Mission Success  –  ****Audit Plan Execution**** **

**  ****Risk Assessment **

** ****Communications**

## Audit Plan Coverage - Example

**  ****5 Business Areas**
**  ****1500+  Programs /   **
**     ****Contracts Over $5M **
**  ****38 Businesses**

**Internal Controls  & Financial **
**International Compliance **
**Programs Execution Audits**
**IT Security / Controls / Disaster Recovery**
**Mgmt. Requests, Process Assessments & Pre-Implementation Reviews **

_**Audit Universe**_

_**Audit Coverage**_

**Notes:**

  Risk Based Audit Coverage Approach.

  Cycle Model Refined Through Risk Assessment.

Focus Areas – Testing of Management’s Assertion and Support of  External Audit’s Attestation on Internal Controls.

Program Coverage Moved to 3–Year Cycle.

  Continued Emphasis on Improving Audit Programs to Facilitate Increased 
   Coverage and Operational Improvements.  

## Agenda

**Agenda**

***  ******Introductions***
*** ******Connections – Engineering and Audit***
*** ******Reflections - Lessons Learned***
-  ***Opportunities ***

## Program Execution Audits

***  ******Assessing Effectiveness of Program Controls In: ***
***Program Planning***
***Risk Management***
***Program Perf. Mgmt.***
***Systems Engineering***
***Software/Hardware Dev.***
***Production and Material Operations***
***Subcontract Mgmt.***
***Program Status Communications***
***Customer Satisfaction***

***Business Self-Assessments Evaluate:***
***Key Business Processes are Effective & Measured to Standards of Excellence***
***Early Warning Systems in Place***
***Continuous Improvement Plans in Place & Monitored***
***Lessons Learned & Best Practices Incorporated Into Key Processes***

## Lessons Learned (Issue Examples )

_**EVMS**_
** ****Baseline Not in Place and/or Maintained**
** ****Techniques Not Utilized**
** ****Cost & Schedule Not Integrated**
** ****Not Fully Implemented (Lack of Mgt Support)**
** ****Training, Knowledge of Benefits**
** ****Resulting Cost Growth “Surprises” Due to Inability to Forecast Performance & at Completion Costs**

_**Subcontract Management**_
** ****S/C Plan Not in Place**
** ****Failure to Meet Tech Req. **
** ****S/C  Qualification Process**
** ****Parts Obsolescence Not Addressed**
**Resulting Delivery Issues,**
** ****Stop Work**

_**EACs/Financial Reporting**_
** ****Comprehensive EACs Not Performed Periodically**
** ****Costs Offset by Future Revenue Not Officially Agreed to By Customer**
** ****Risks Not Covered in Contract Status Reviews **

_**Systems Engineering**_
** ****Contracts Lack Sufficient Definition of Customer Requirements & Acceptance Criteria**
** ****Program Plans Not in Place**
** ****Change Control Issues**
** ****Drawing Changes Not Completed Timely**

## Lessons Learned (Issue Examples) 

_**Risk Management & Future Risk Exposure**_
**Cost, Technical, Subcontract, Schedule Risk  Items Not Captured**
**“****Culture” Doesn’t Exist for Risk Identification & Mitigation**
**Lack of Mitigation Plans and Activities **
** ****Resulting In Cost Impacts**

_**Program Management Process**__** **_
**Inadequate Procedures to Define  Process & Training Issues**
**No Resource Allocation Plans**
**Lack of Authority for PMs**
**Critical Staffing Shortfalls**
**Return to Green Plans Not in Place**

_**Proposals and Program Planning**_
** ****Plans Not Carried Forward to Achieve Proposal Challenges**
** ****Risks and Issues Minimized**
** ****Risks Not Carried Forward in Program Execution**
** ****Program Plans Not Developed and/or Not Utilized **

## IT Audit Coverage – Issue Examples

_**Network and Internet Security**_
**Absence of approval or knowledge of the total inventory of Network Connections**
**Unnecessary  ports and services open**
**No IDS System or perceived need by management for reviewing logs **
**Unapproved firewall products in use **
**Lack of modem sweeps**

_**Disaster Recovery**_
**Non-existent or outdated Risk Assessment **
**RA done w/o data owner or management input/approval**
**New systems brought on-line since the last RA and not evaluated **
**Disaster Recovery Plan is outdated/incomplete**
**Off-site storage requirements  not considered**

_**Electronic Information Protection**_
**Lack of understanding by employee's of what is sensitive and who has access**
**Management commitment to safeguarding sensitive information**
**Employee-managed file shares not configured properly**

_**Operating System Controls**_
**Terminated employee/contractor accounts that still exist and are active**
**Banner statements don’t comply with the policy**
**Anti-virus software not installed or out of date**
**Systems  not patched, not configured properly, & critical system files not protected from external or internal threats**
**Sys Admins not adequately trained and/or unfamiliar with policies/handbook**

## Advisory Services

*** ******Special Audits & Advisory Services***
***Key Initiatives***
***Process Improvements & Effectiveness***
*** ******Management Requests***
*** ******Ethics & Other Special Investigations***

## Agenda

**Agenda**

***  ******Introductions***
*** ******Connections – Engineering and Audit***
*** ******Reflections - Lessons Learned***
-  ***Opportunities ***
*** ******Resources***
*** ******Evolution***

## Audit Resources 

**PUSH **

**PULL**

**“****Waiting List”**

**“****Waiting Line”**

**                          ****Audit Council               Subject Matter Experts (SME) **
**            ****Technical Partners                                            External Institutes/Forums**

**Supporting**

**INTERNAL**
**AUDIT**
**  ****Rotational**
**  ****Subject Matter Experts**

**Notes:**
  BLDP Model continues be to Cornerstone of Audit Staffing Strategy

  Critical Skill Needs Addressed on an On-going Basis
   (CPAs, Engineers, Subject Matter Experts)

## Audit Program Enhancements

** ****Management Requests**
** ****Program Execution Reviews**
** **
** ****Ongoing Risk Assessment**
**  ****(Headlines  & Metrics)**

**Audit Program Enhancements**

**Continuous Process Improvement**

**Reactive - >   Proactive   - >   Preventive**

**  ****Education**
**  ****Risk Indicators **
**  ****Sharing**
** “****Keep It Closed”**
** ****Self-Assessment**

** ****Ethics Investigations**
** “****Post Mortem” **
**   ****Support**

## Slide 21