Technology GRC | PKF IT Governance & Compliance

Identify IT risks. Design secure systems. Demonstrate compliance.

Digital business processes and high-performance IT systems are crucial to a company’s success. At the same time, requirements for IT security, internal controls, and regulatory compliance are increasing.

The PKF Wulf Group supports medium-sized companies in implementing and auditing business-critical IT systems, further developing their IT governance, and meeting compliance requirements.

Our Technology GRC experts combine IT expertise with experience in auditing and business processes. This enables us to help you identify risks early on, design effective controls, and safely navigate digital transformation projects.

Request IT Governance Consulting

Please contact me

Oliver Völkl

Partner, Head of Technology Governance, Risk and Compliance

Stuttgart

Zum Personenprofil Nachricht schreiben Anrufen

Using Technology Responsibly

IT Governance and Risk Management for Small and Medium-Sized Businesses

Whether it’s a new ERP system, increasing regulatory requirements, or expanding IT infrastructures, companies must ensure that their IT not only functions properly but is also appropriately monitored and managed.

This raises a number of key questions:

Executive Management: What IT risks exist, and how do we fulfill our governance and compliance responsibilities?
IT Management: How do we design secure IT processes, control access permissions, and reduce risks during system migrations?
CFO and finance leaders: How do we ensure reliable financial data, effective IT controls, and audit-ready processes?

Technology Governance, Risk & Compliance (Technology GRC) brings these perspectives together. This includes clear responsibilities, documented IT controls, a structured approach to risk management, and compliance with relevant legal and regulatory requirements.

We support you in developing appropriate measures and integrating them into existing business processes.

Positioning Companies for the Future

IT governance is also a management responsibility

As digitalization advances, the demands on corporate management are growing. A lack of IT policies, unclear responsibilities, and inadequate controls can lead to significant business and liability risks.

Effective IT governance creates transparency, defines responsibilities, and makes IT risks manageable. We help you evaluate existing structures and establish appropriate control processes.

Our Services

Technology GRC at a Glance

Our consulting and support services focus on three closely related areas: ensuring the success of digital transformation projects, further developing IT governance and controls, and implementing regulatory requirements.

ERP Assessment and Digital Transformation

ERP Implementation and System Migration with Manageable Risks.

The implementation or migration of an ERP system has a profound impact on business processes, financial accounting, and internal control structures. Errors in data migration, insufficient testing, or inappropriate authorization models can disrupt business operations and compromise the reliability of financial information.

With our ERP assessments, we support companies before and after go-live and evaluate selected risks associated with the system implementation.

Our services include:

Project and Concept Review: Review of key project decisions, business concepts, and organizational framework conditions.
Test management: Review of test specifications, test case documentation, and release processes.
Data migration and interfaces: Evaluation of migration concepts, migration tests, and selected interfaces.
Authorization Concepts: Review of roles, access rights, and monitoring mechanisms.
Go-live and post-go-live assessments: Identification of selected risks before and after the system goes live.

The scope is tailored to the specific project—ranging from a focused go-live check to a more comprehensive ERP assessment.

Your benefit: You receive a structured and independent assessment of key project risks, including specific recommendations for your project team and management.

IT Governance and Internal IT Controls (ITGC)

Clear responsibilities and transparent IT processes.

Effective IT governance provides transparency regarding responsibilities, risks, and controls. Documented processes are particularly important for business-critical applications to mitigate IT risks and meet the requirements of internal or external audits.

We support and guide companies in the development, documentation, and refinement of their IT policies and IT controls.

This includes, in particular:

User and access rights management
Change management and software changes
Incident management
Backup & Recovery
Monitoring of IT service providers
Password and IT Security Policies
Regulations for the Use of Artificial Intelligence
IT Operational Processes and Job Scheduling

A key focus is on what are known as IT General Controls (ITGC). These general IT controls form an important foundation for reliable IT-supported business and financial processes.

Even after an IT audit, we continue to support the further development of existing controls. In structured follow-up assessments, we review the documented status of agreed-upon measures and identify any remaining areas requiring action.

Your benefits: Traceable IT processes, clearly defined responsibilities, and a stronger foundation for both internal and external audits.

Authorization Schemes and Access Controls

Who Is Authorized to Do What? Identify and Control Critical Access Rights.

In many companies, access permissions accumulate over the years. New employees, changing responsibilities, and additional IT applications increase the risk of inadequately controlled access rights.

A structured authorization strategy defines which individuals are permitted to access which systems, data, and functions.

We provide support and guidance in creating and reviewing authorization strategies for ERP systems and other business-critical applications.

Our services include:

Development and documentation of role and authorization frameworks
Analysis of critical access rights and segregation of duties (SoD) conflicts
Policies for privileged access and emergency users
Documentation of authorization and revocation processes
Development of appropriate monitoring and control procedures

Your benefits: Transparent access rights, reduced authorization risks, and traceable control processes.

NIS-2 Consulting and Readiness Assessment

Identify and systematically implement IT security requirements.

With NIS-2, numerous companies in Germany are subject to expanded requirements for information security and cyber risk management. Affected companies must implement appropriate risk management measures and define organizational responsibilities.

We support you with a structured NIS-2 readiness assessment to evaluate the implementation status of selected requirements and identify relevant areas for action.

In doing so, we consider, among other things:

Current classification of NIS 2 applicability
IT risk analyses and risk registers
Governance and organizational responsibilities
Incident management and reporting processes
Business continuity and crisis management
Security of IT Systems and Applications
IT Supply Chain and Service Provider Risks
Training and Awareness Initiatives

Based on this, we develop prioritized recommendations for further implementation.

Your benefit: Transparency regarding the current status of implementation and a clear basis for prioritizing necessary measures.

BSI C5 – Cloud Compliance and Testing

Provide verifiable evidence of security controls for cloud services.

For cloud service providers, independent verification of the security of their systems and processes is becoming increasingly important.

The Cloud Computing Compliance Criteria Catalogue (C5) of the Federal Office for Information Security (BSI) defines requirements for the information security of cloud services.

We support cloud providers in preparing for and conducting C5 audits.

Our service portfolio includes:

C5 gap analysis and audit preparation

Comparison of existing control measures against the C5 criteria, identification of areas for improvement, and support in developing audit-relevant documentation.

C5 Type 1 Audit: Assessment of the design and adequacy of relevant controls as of a specific date.
C5 Type 2 Audit: Additional assessment of the effectiveness of relevant controls over a defined audit period.

C5 reports may be particularly relevant for cloud providers that serve security-critical customers or are subject to specific verification requirements, such as in the healthcare sector.

Your benefits: Structured preparation for the C5 audit and robust evidence for customers and other stakeholders.

IT Service Provider Risk Management – Third-Party Risk Management

Identify and effectively manage external IT dependencies.

Cloud platforms, data centers, and specialized IT service providers often handle business-critical functions. However, companies remain responsible for appropriately managing the resulting risks.

With our IT Third-Party Risk Management (IT-TPRM), we support and guide you in establishing transparent structures for monitoring external IT service providers.

This includes:

Creating a registry of IT service providers and applications
Identifying critical service providers and dependencies
Assessment of risks, such as vendor lock-in
Defining responsibilities using a RACI matrix
Development of a risk register
Establishment of regular monitoring and review processes

Your benefits: Greater transparency regarding external IT dependencies and a structured approach to managing service provider risks.

From Analysis to Implementation

Our Consulting Approach

IT governance and compliance must be tailored to the company. That is why we take a risk-based approach that takes into account both the existing system landscape and the organizational framework.

1. Clarify the current situation and objectives

Together, we define the relevant systems, processes, and issues. This ensures that the assessment focuses on the risks that truly matter.

2. Analyze existing structures

We review selected policies, guidelines, controls, and supporting documentation. Interviews with the responsible individuals supplement the document analysis.

3. Evaluate the need for action

Findings are presented in a structured format and accompanied by practical recommendations for action.

4. Support implementation

Upon request, we assist in developing appropriate guidelines, concepts, and control processes or review the implementation of agreed-upon measures.

You will receive transparent results that serve as the basis for management decisions and further project work.

Why Choose Technology GRC with the PKF Wulf Group?

We combine IT expertise with auditing and business practice.

IT risks are rarely purely technical issues. They affect business processes, financial information, internal controls, and regulatory requirements.

This is precisely where our strength lies.

Experience in financial auditing and IT auditing

We understand the requirements for IT systems relevant to financial reporting, internal controls, and audit-related documentation.

Practical Consulting for Small and Medium-Sized Businesses

We focus on specific issues and develop recommendations tailored to the size, complexity, and risk profile of your company.

Consulting with a Focus on Business Processes

We consider not only technical systems but also their significance for workflows, responsibilities, and corporate governance.

Personal Points of Contact and Interdisciplinary Collaboration

Our Technology GRC specialists collaborate as needed with other experts from auditing, accounting, and management consulting, as well as with attorneys. Audit and consulting engagements are kept separate from one another in compliance with professional independence requirements.

Let's work together to solve your IT challenges.

Oliver Völkl is a partner at the PKF Wulf Group and heads the Technology Governance, Risk & Compliance practice. With his many years of experience in IT auditing and consulting, he understands the challenges at the intersection of IT, business processes, and regulatory requirements. Together with his team, he develops solutions tailored to your company’s needs.

Contact Oliver Völkl

Frequently Asked Questions About IT Governance, ERP, and IT Compliance

What is Technology Governance, Risk, and Compliance (GRC)?

Technology GRC encompasses the control and monitoring of IT systems, the management of technological risks, and compliance with relevant regulatory and internal requirements. This includes, for example, IT governance, access control policies, IT controls, IT risk management, and compliance documentation.

Is management liable for inadequate IT security?

Yes, under certain circumstances, managing directors may be personally liable if they fail to fulfill their organizational and oversight duties regarding IT security and the company suffers damage as a result. The responsibility for appropriate risk management does not rest solely with the IT department. Clear lines of responsibility, documented IT policies, and effective control processes help limit risks and demonstrate compliance with management duties.

What responsibilities does management have under NIS-2?

Under Section 38 of the BSIG, the management of particularly important and important facilities must implement the required cybersecurity risk management measures, monitor their implementation, and regularly participate in relevant training. Negligent breaches of these obligations may result in liability. A NIS 2 Readiness Assessment helps to systematically evaluate existing measures and areas requiring action.

Does a medium-sized company need binding IT policies?

Legal requirements and the necessary scope depend on the specific company. However, documented policies are particularly important in established IT structures to ensure that responsibilities, authorizations, and control processes are regulated in a transparent manner. These include, for example, change management, backup and recovery, incident management, and the monitoring of IT service providers. A lack of such policies can increase security, compliance, and audit risks.

How can companies identify IT risks and control gaps?

A structured IT risk assessment examines business-critical systems, processes, access permissions, and existing controls. Among other things, it takes into account potential outages, unauthorized access, inadequate documentation, and external IT dependencies. The results form the basis for a risk-based prioritization of appropriate measures.

What are the risks involved in switching ERP systems?

ERP migrations can pose significant risks to business processes and financial information. These include faulty data migrations, incomplete interfaces, inadequate testing procedures, and critical access permissions. An ERP assessment before or after go-live helps identify such risks and determine targeted improvements.

Why are IT controls relevant to CFOs and the annual financial statement audit?

Many financial processes rely on ERP systems and automated applications. General IT controls (ITGC—IT General Controls) support the reliability of these systems, for example, through regulated access permissions and controlled software changes. Missing or ineffective controls can result in additional audit work and impair the reliability of financial reporting information.

How can companies reduce risks associated with external IT service providers?

Companies should know which IT service providers deliver business-critical services and what dependencies arise as a result. Structured IT service provider risk management includes, among other things, a service provider registry, risk analyses, clear responsibilities, and regular monitoring measures. This allows for better management of risks arising from outages, security vulnerabilities, or vendor lock-in.

Expertise

Industries

We are PKF

IT Governance, Risk, and Compliance for Businesses