Social media

Beyond the risks, how it can work in organisations

For the Institute of Internal Auditors, Australia

Walter Adamson GM Victoria, iGo2 Group
walter.adamson@igo2group.com 4 December 2012

Objectives of this webinar

To allow Internal Auditors to:

communicate effectively with those managing the use of social media when they are conducting an audit

to understand the inherent release of control of information posted

in social media

to understand the tools and systems which might be in use to distribute and monitor social media activity

to understand what governance and control means regarding social media when its utility is heavily linked to not being in control

Walter Adamson

Set up BHP IS Audit Group Certified IS Auditor CIO (Asia Pacific Minerals) Certified Social Media Strategist (2009) Linkedin.com/in/adamson My social web: xeeme.com/walter
@adamson

Audience poll #1

Which networks do you

currently use?

COMMUNICATE CORE TERMS

Some key social media facets

Strategy

formulating policy and strategy through researching your brand, customers, partners and competitors

Intelligence
Communities Governance

monitoring, collecting and analyzing social data to make informed, agile business and policy decisions building owned social platforms for listening, support, building, collaborating, content

social business metrics, ROI, policy and guidelines, processes

How to think about social

Elevate your view. Take a look down from on high:

Its not about the tools but about what you want to achieve

Social network fundamentals

Three key issues:

1.

N Network size

2.
3.

C Contribution
P Participation

The behavioural and methodological foundation of success

in social media lays in the NCP Model

Social Presence

What is Presence?

Presence is about your voice being heard

Reach is about increasing the

pathways for your voice to travel

Influence is about increasing

the impact your voice has on others.

Social Architecture

Social Media Policy

Specifically, it should:

Educate employees, then empower them; Help employees understand and own the risks;

Hold employees accountable; Address organization social media account ownership and handoffs when spokespeople leave.

RELEASE OF CONTROL

Audience poll #2

Do you find social media to be challenging to audit because it

is changing so fast?

Challenge

Simply put, the risk challenge with social is because of its

potential viral and permanent nature.

Loss of control Hashtags become Bashtags

Dude, I used to work at McDonalds. The #McDStories I could tell

would raise your hair. (via Twitter) #McDStories I lost 50lbs in 6 months after I quit working and eating

at McDonalds (via The Daily Mail)

These #McDStories never get old, kinda like a box of McDonalds 10 piece chicken McNuggets left in the sun for a week (via The LA Times)

McDonalds execs recognized the PR disaster in progress and ended

the campaign after two hours. But it was too late. The trending topic
had already gained a life of its own.

Good news! There IS a methodology

1.Assess

8.Monitor

2.Strategise

7.Engage

Social Business Framework

3.Create

6.Share

4.Protect
5.Participate

Examine risks by business use case

Recruitment & Retention

Investor relations Public relations Marketing / branding

Lead generation Customer service & complaints

Innovation & product development Employee relations Business partner relations

Key is to integrate social with business

Social strategy which aligns with
business strategy
2.

1.

Social business risk which is part of business risk management and

compliance programs

Regulators ? Advertising Standards

Bureau, ACCC, Australian

Association of National Advertisers (AANA), ASIC, APRA, etc.

Internal audit as a partner

As advisers, internal audit can partner with management to develop a strategy in such a way that it does not violate the International Standards for the Professional Practice of Internal Auditing. You cant even address lower issues until youve really got a strategy and governance process in place.

- Mike Jacka, a senior audit manager with Farmers Insurance Group (Phoenix).

TOOLS AND SYSTEMS

When Social goes Wrong

Governance Monitoring Risk Management Crisis Management

Bankrupt!

Customer

Brand
(You)

Partner

Competitor

1. Assess

8.Monitor 2.Strategis e

6.Share

3.Create

Phase 8 Monitor

6.Share

4.Protect

5.Participat e

Monitoring tools and services decided

Keyword and location searches Competitor tracking Brand tracking

Key measures agreed

Integration in place Workflow and escalation processes

defined

Mobile considered

Monitoring fundamentals
Be aware that tools have 3 parts:
1. 2. 3.

Social data sourcing Data processing and analysis Reporting and insight delivery

Does Listening support governance?

Does the listening platform

support governance rules and roles and workflow?

If it cant exceptions are created.

Social listening post - tools

Workflow and decision tree

GOVERNANCE AND CONTROL

What would it mean to you if you could assure your organisation that social media was well controlled?

Social Media Marketing Has Caused Internal Business Challenges EMPLOYEES

Inappropriate use of social media

EXPANDING
Social media footprint

INTERNAL

Confusion of roles & responsibilities

NON-EXISTENT DISJOINTED

Governance models & policies

INCONSISTENT
Social media measurement practices

Content & Community Practices

OUTDATED
Crisis communications models

TECHNOLOGY
Disjointed and uncoordinated

Confusion of Roles and Responsibilities

This is one of the most common problems we see

Confusion of Roles and Responsibilities

Its not just the Team

Its about cross-organisational roles and coordination.

6 Step Audit Approach

Strategy Assessment overall goals Presence Assessment where are you the social web
Listening Assessment what data and how managed Organisation & Internal Culture Assessment Process Assessment workflow, timeliness, escalation

1.
2. 3. 4. 5.

6.

Governance Assessment
Policy Roles Risk Assessment Compliance

Consider starting with an Assessment

A big challenge is trying to

figure out everything thats going on, because you will be shocked

by the different people doing

social media that you dont even know about, says Mike Jacka.

Organisational Model for Social Media

Then, get a grip on the model

OR

Check Approval Workflows e.g. For New Presence Creation

Yes

Be sure to connect with them. Reach out to the Social Business Center of Excellence

Yes

Do you know the internal contact?

No

Yes

Yes

Have you reviewed the Social Media Guidelines?

No

Is there a true need to create a new social media channel?

No

Is there a preexisting presence you can partner with?

1. Have you notified your manager about this?

Looks like you may need to create a presence but two considerations. 2. Do you have resources to sustain the presence long term?

Yes

See #2.

No

Be sure to discuss with your manager

No

Yes

Hold off until there is community demand

Create a presence and not social media team.. Share PW with manager

Review Social Media Guidelines

Im Not Sure

Click here to connect with the Social Business COE to discuss.

No

Discuss needs with manager

Finish
To allow Internal Auditors to:

communicate effectively with those managing the use of social media when they are conducting an audit

to understand the inherent release of control of information posted

in social media

to understand the tools and systems which might be in use to distribute and monitor social media activity

to understand what governance and control means regarding social media when its utility is heavily linked to not being in control

CONCLUSION
You can successfully apply internal audit frameworks to social media.

APPENDICES FOR REFERENCE

1. Assess

8.Monitor

2.Strategis e

7.Engage

3.Create

4. Protect Phase of iGo2 Strategy Methodology Overview

6.Share

4.Protect
5.Participat e

Regulatory compliance considered

Data collection, retention and archiving determined

Employee protections in place, including the social media policy and training Company protections in place, including legal

Social architecture assessed in context of risk and monitoring

Crisis management plan developed and integrated Risk assessment and risk management in place and practice is conducted Executive and Board reporting in place critical items in relation to

business strategy and risk

1. Assess

8.Monitor

2.Strategis e

7.Engage

3.Create

6.Share

4. Protect Phase Risk Management - 1

4.Protect
5.Participat e

Identify listening, brainstorming, reviewing

Assign an owner
Qualitative or quantitative evaluation Mitigation accept, reduce, reject, transfer

Categorising social media risk:

Reputation Compliance and regulatory Legal, IP, Privacy

Operational reducing employee productivity

1. Assess

8.Monitor

2.Strategis e

7.Engage

3.Create

6.Share

4. Protect Phase Risk Management - 2

4.Protect
5.Participat e

Identify and review risks

Review historical activities

Workflow triage from listening Review 3rd party case studies and reports

Create and review threat lists

Incorporate risk management into social initiatives Keep up with platform developments and associated legal terms

A Multi-level Governance Model

0th level: Terms of Usage posted with some very simple

"guidelines" (not policy, not rules, etc.) 1st level: community managers and/or helpful individuals

2nd level: corporate platform managers

3rd level: exec sponsors 4th level: ad-hoc committee of exec VPs (IT, HR, etc.) for issues that

requires serious discussion

Levels 0 through 2 open and transparent, e.g. anyone can comment

and/or contribute.

Awareness

Mark Pearson @journlaw

Social media best practice: New

guidelines released Australian

Association of National Advertisers (AANA) see
http://www.leadingcompany.com.au/technolog
y/social-media-best-practice-new-guidelinesreleased/201211283150