Audit Programs Management for Security Teams

I for one am being hit with audits for SOX, CISP, SDP, HIPPA, GLBA, and
other various internal audits all at one time (or rather at least 2 or 3
of them at any one time throughout the entire year).  They all cover
some of the very same things (based on testing for due care), but what I
am really interested in is finding out how other security organizations
manage their involvement in these activities in a coordinated manner
that cuts down on the amount of repeat work taking place.  We are taking
steps to restructure our security program around COBIT (which should
help), but what are some of the other things that can be done?  I've
appointed a member of my team as the responsible party for pulling
together an IT Audit and Findings Management program and would like to
provide her with a few thoughts on the subject (other than just my own).


Thanks,

========================
Brad Bemis, CISSP, CISA, CBCP
Supervisor - Enterprise Security
Nordstrom, Inc.
(206) 233-5332
========================
Nordstrom's commitment to
superior customer service extends
to proper protection of the sensitive
personal information entrusted to us
by our customers.