Information Systems Audit and Control Association Inc

“THE INFORMATION SYSTEMS AUDIT AND CONTROL ASSOCIATION, INC.'S (ISACA) BYLAWS ("2003 BYLAWS") WERE LAST REVISED IN 2003. IN 2012, THE GOVERNANCE committee, AT THE REQUEST OF THE BOARD OF DIRECTORS ("BOARD") AND WITH THE ASSISTANCE OF ISACA STAFF AND LEGAL COUNSEL, BEGAN A COMPREHENSIVE REVIEW OF THE 2003 BYLAWS. THIS REVIEW PROVIDED THE BASIS FOR A FULL REFRESH OF THE 2003 BYLAWS TO ALIGN TO BEST PRACTICES AND EMBED APPLICABLE LAW IN THE NEW BYLAWS ("NEW BYLAWS"). MANY OF THE CHANGES TO THE 2003 BYLAWS SIMPLY UPDATE EXISTING PROVISIONS, FOR EXAMPLE, THE NEW BYLAWS ALIGN MEETING NOTICE, QUORUM REQUIREMENTS, AND THE MANNER IN WHICH MEETINGS ARE CONDUCTED TO CURRENT LAW; MORE CLEARLY SPECIFY THE DUTIES OF DIRECTORS AND OFFICERS; ESTABLISH TWO STANDING COMMITTEES: FINANCE AND THE NOMINATING COMMITTEE; DELETES THE BYLAWS COMMITTEE AS A STANDING COMMITTEE (NOTING THAT THIS CAN BE CREATED BY THE BOARD AT ANY TIME); AND AUTHORIZES THE BOARD TO CREATE OTHERS IN ITS DISCRETION. THE NEW BYLAWS ALSO DELETED A PROHIBITION ON A BOARD-APPROVED DEFICIT BUDGET; CREATE A NEW CLASS OF MEMBER: NON-VOTING; MAKE THE CEO A VOTING DIRECTOR AND THE SECRETARY FOR ISACA; INCLUDES THE THREE (3) IMMEDIATE PAST PRESIDENTS (FORMERLY TWO) AS MEMBERS OF THE BOARD; REDUCES THE MAXIMUM NUMBER OF VICE-PRESIDENTS FROM NINE (9) TO SEVEN (7); LIMITS THE NUMBER OF DIRECTORS TO TWENTY-FIVE (25) (THE BOARD MAY SET THE NUMBER IN THOSE PARAMETERS) AND LIMITS THE NUMBER OF DIRECTORS THE INTERNATIONAL PRESIDENT CAN APPOINT. THE FULL DOCUMENT WAS APPROVED BY THE ISACA BOARD OF DIRECTORS AND PRESENTED TO ISACA MEMBERSHIP FOR A VOTE: THE MEMBERS VOTED TO APPROVE THE NEW BYLAWS.”

“Information systems audit and control association (isaca) maintains a membership of individuals; there is no corporate membership category. Anyone interested in the purposes and objectives of the association is eligible for membership. The vast majority of isaca members also belong to a local chapter (membership in isaca is required for anyone holding membership in a chapter). A member-at-large category exists for individuals who wish to join isaca but who live at such a distance from a local chapter that attendance at meetings is prohibitive. Student and retired member categories are offered as well. Isaca's membership is characterized by diversity. The constituents live and work in more than 180 countries and run the gamut of job titles, including information system auditor, consultant, educator, information security manager, regulator, chief information officer, internal and external auditor, compliance officer, risk manager and student. Some are new to the field, while others are at middle management levels or senior ranks. They work in finance and banking, public accounting, hospitality, health care, government and the public sector, utilities, manufacturing and retail. Isaca members embrace this diversity as providing a vast learning ground where they may delve into the challenges and opportunities faced by colleagues in other countries, positions or industries. Isaca recognizes that its members constitute an extensive and varied pool of expertise; expertise the association counts on to help provide services and products that engender credibility and capability in its constituents. The more members, the more expertise; the more expertise, the better the ability to meet constituent needs. Isaca's members are its most valuable asset.”

“Information Systems Audit and Control Association (ISACA) has a Nominating Committee that prepares a slate of officers (international president and vice presidents) for member review. Members may submit the names of additional candidates by way of petition prior to 120 days before the Annual Meeting of the Membership. The petition must be signed by one-twentieth of 1 percent of the members in good standing, equaling a minimum of 100 members, no more than 20 of which may be from any one chapter. If members propose additional candidates or if the Nominating Committee itself proposes more candidates than there are openings on the Board of Directors, an election is held. If an election is held, the election is conducted by mail ballot. Only those ballots received 20 or more days prior to the Annual Meeting are counted. Results of the election are certified by an independent professional group and announced at the Annual Meeting. If no additional candidates are proposed by the members, or the Nominating Committee's slate presents a number of candidates which does not exceed the number of openings available, the committee's slate is considered elected by acclamation.”

“WHEREAS NOT ALL DECISIONS OF THE BOARD OF DIRECTORS ARE SUBJECT TO REVIEW AND APPROVAL BY THE MEMBERSHIP, CERTAIN ONES ARE. EACH YEAR, AT THE ANNUAL MEETING OF THE MEMBERSHIP, THE FOLLOWING ITEMS ARE PRESENTED TO THE MEMBERS IN ATTENDANCE: - HIGHLIGHTS OF DECISIONS MADE BY THE BOARD OVER THE PREVIOUS YEAR - THE PREVIOUS ANNUAL MEETING'S MINUTES - THE TREASURER'S REPORT - APPOINTMENT OF THE ASSOCIATION'S INDEPENDENT AUDITORS FOR THE FOLLOWING YEAR THE NEW BYLAWS REQUIRE THE MEMBERS TO VOTE ON ANY CHANGES TO THE BYLAWS THAT (I) MATERIALLY AND ADVERSELY AFFECT THE MEMBERS' RIGHTS AS TO VOTING, DISSOLUTION, REDEMPTION, OR TRANSFER; (II) INCREASE OR DECREASE THE NUMBER OF MEMBERS AUTHORIZED IN TOTAL OR FOR ANY CLASS; (III) EFFECT AN EXCHANGE, RECLASSIFICATION, OR CANCELLATION OF ALL OR PART OF THE MEMBERSHIPS; (IV) AUTHORIZE A NEW CLASS OF VOTING MEMBERSHIP; (V) INCREASE OR EXTEND THE TERMS OF DIRECTORS; (VI) INCREASE THE QUORUM FOR MEMBERS' MEETINGS; (VII) REPEAL, RESTRICT, CREATE, EXPAND, OR OTHERWISE CHANGE PROXY RIGHTS; or (VIII) AUTHORIZE CUMULATIVE VOTING. FURTHER, WHERE AMENDMENTS TO THE BYLAWS REQUIRE APPROVAL BY THE MEMBERS AS SET FORTH UNDER THE CORPORATIONS CODE AS STATED ABOVE, THE AMENDMENT MAY BE APPROVED BY THE VOTE OF A MAJORITY OF THE MEMBERS PRESENT AT A MEETING AT WHICH A QUORUM IS MET OR BY MAIL/ELECTRONIC BALLOT.”

“THE 2015 FORM 990 FOR INFORMATION SYSTEMS AUDIT AND CONTROL ASSOCIATION (ISACA) WAS PREPARED BY COHNREZNICK LLP (COHNREZNICK), BASED UPON INFORMATION PROVIDED BY ISACA. THIS DOCUMENT SUMMARIZES THE REVIEW POINTS AND AVAILABILITY ASSOCIATED WITH THE RETURNS. THE DATA FOR THE RETURN WAS COMPILED BASED ON INFORMATION PREPARED FOR THE 2015 AUDIT, AS WELL AS OTHER ACCOUNTING RECORDS. THIS INFORMATION WAS SUBMITTED TO COHNREZNICK FOR PREPARATION OF THE RETURNS. IN ADDITION TO THE FINANCIAL INFORMATION COHNREZNICK RECEIVED, COHNREZNICK HAD AN OPPORTUNITY TO RAISE QUESTIONS ABOUT GOVERNANCE AND OTHER ISSUES, AND REQUEST ADDITIONAL INFORMATION AS NEEDED. THE NARRATIVE EXPLANATIONS OF PROGRAM ACCOMPLISHMENTS AND POLICIES WERE COORDINATED WITH THE applicable DIRECTORs AND THE MEMBERS OF THE EXECUTIVE TEAM. UPON COMPLETION OF THE RETURN, SEVERAL LAYERS OF REVIEW WERE CONDUCTED: - INITIAL REVIEWS OF RETURN: THE INITIAL REVIEW OF THE COMPLETED RETURN WAS COMPLETED BY THE RESPECTIVE STAFF WITHIN THE FINANCE DEPARTMENT. - SENIOR MANAGEMENT REVIEW: FOLLOWING THE INITIAL REVIEW, THE EXECUTIVE TEAM INCLUDING THE CEO WERE PROVIDED A COPY OF THE RETURN FOR COMMENT. THE CEO AND SR. DIRECTOR OF HUMAN RESOURCES ALSO PROVIDED AN ADDITIONAL REVIEW OF THE COMPENSATION-RELATED AREAS. COMMENTS WERE FORWARDED TO COHNREZNCIK FOR INCORPORATION INTO THE RETURN. - VOLUNTEER REVIEW: THE COMPENSATION COMMITTEE WAS presented THE COMPENSATION-RELATED SECTIONS OF THE RETURN (AS OUTLINED IN ITS CHARTER) for review and comment. -- THE ORGANIZATION'S GOVERNANCE committee CHAIR REVIEWED THE return. -- COMMENTS FROM THESE REVIEWS WERE EVALUATED AND PROVIDED TO COHNREZNICK, WHO UPDATED THE RETURN, IF APPLICABLE. -- THE BOARD OF DIRECTORS WAS PROVIDED ACCESS TO THE RETURN VIA THE BOARD vantage (WEB SITE) PRIOR TO ITS FILLING.”

“INFORMATION SYSTEMS AUDIT AND CONTROL ASSOCIATION (ISACA) HAS A FORMAL WRITTEN CONFLICT OF INTEREST POLICY ADDRESSING INSTANCES WHERE A THIRD-PARTY RELATIONSHIP OF A PAID CONSULTANT, VOLUNTEER AND/OR EMPLOYEE COULD IN SOME WAY POTENTIALLY PRESENT OR APPEAR TO PRESENT A COMPROMISE RELATED TO ACTIONS AND DECISIONS MADE ON BEHALF OF ISACA. THE POLICY ALLOWS FOR REMEDIES AND/OR APPROPRIATE RESPONSES BASED ON A JOINT DETERMINATION BY ISACA MANAGEMENT AND VOLUNTEER LEADERSHIP OF THE NATURE AND EXTENT OF THE POTENTIAL CONFLICT. THE CONFLICT OF INTEREST POLICY IS REVIEWED ON A PERIODIC BASIS BY THE GOVERNANCE committee AND APPROVED BY THE ISACA BOARD OF DIRECTORS. POTENTIAL CONFLICTS OF INTEREST ARE DOCUMENTED AND MONITORED EACH YEAR, THROUGH (1) SELF-PROCLAMATIONS MADE BY INDIVIDUAL VOLUNTEERS WHO SIGN THE PARTICIPATION AGREEMENTS REQUIRED FOR PARTICIPATION IN ASSOCIATION BOARDS, COMMITTEES, SUBCOMMITTEES AND TASK FORCES; (2) DISCLOSURE OF CONFLICTS IN STANDARD CONSULTING AGREEMENTS; AND (3) DISCLOSURE BY ISACA EMPLOYEES UPON HIRE (AND ANNUALLY) BY REVIEW AND SIGNATURE OF THE ORGANIZATION'S EMPLOYEE AGREEMENT. CONSULTANTS, VOLUNTEERS AND EMPLOYEES ARE ENCOURAGED TO REPORT ANY CONFLICTS THAT MAY ARISE THROUGHOUT THE YEAR. IF SUCH INSTANCES ARE REPORTED, THEY ARE DEALT WITH AT THAT TIME AND BASED ON THE CIRCUMSTANCES RELATING TO THE POTENTIAL CONFLICT.”

“The compensation philosophy of information systems audit and control association (isaca), which is affirmed by the board of directors, is to provide competitive compensation and benefits coverage in support of the goals and objectives of the organization. The compensation philosophy is supported by the use of an independent compensation consulting firm and the establishment of a compensation committee composed of independent members of the board of directors (current and two immediate past international presidents). Based on the compensation philosophy, the compensation range for the ceo is developed by the compensation consultant and reported to the committee. Compensation ranges are also developed by the consultant for the executive management team with compensation variances to the ranges provided to the committee. Ranges are calculated based on position responsibilities and a compilation of published compensation surveys for defined comparative groups representative of isaca. In addition, available data from filed irs form 990s may be used to supplement the survey data utilized by the compensation committee. The final report of the compensation consultant as accepted by the committee, the compensation philosophy, and contract (if applicable) then serve as the basis for the determination compensation, consisting of base salary, total cash compensation and benefits. Determination for executive management is made by the ceo based upon the accepted compensation ranges. Determination for the ceo is made by the compensation committee itself. This process is completed on an annual basis, gathering the information necessary to evaluate the market competitiveness of isaca's compensation; provide data on executive compensation from a control and governance standpoint; and facilitate isaca's ability to attract, retain and motivate quality staff, accomplish organizational objectives and provide value to its constituents, which isaca considers critically important to its future.”

“The following documents are posted to the web site and provided upon request: (1) participation agreement and intellectual property (ip) waiver, which outlines the conflict of interest policy and intellectual property ownership issues and is required to be signed by all volunteers; (2) the articles of incorporation of the organization and bylaws of the organization; and (3) the annual report. Information systems audit and control association (isaca) does not have a form 1023, but it does provide the irs letter of determination, upon request. In addition, form 990 is publicly available through guidestar's web site and the illinois attorney general's web site.”

“Information Systems Audit and Control Association (ISACA) serves both individuals and enterprises by being a leading global provider of knowledge, certifications, community, advocacy and education on information systems assurance and security, governance of enterprise information technology (IT), IT-related risk and compliance, and other topics related to ensuring trust in, and value from, information and information systems. Founded in 1969, ISACA sponsors international conferences, publishes the ISACA Journal, conducts and publishes research, provides benefits globally to more than 140,000 members and constituents (association members and certification holders), and develops international information systems auditing and control standards. ISACA also administers the globally respected Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified in the Governance of Enterprise IT (CGEIT), Certified in Risk and Information Systems Control (CRISC), and cybersecurity practitioner (csxp) designations. ISACA supports development, update and education activities related to COBIT 5, a globally adopted business framework for governing and managing enterprise information technology and Cybersecurity Nexus (CSX), which offers credentialing, training and career development for cybersecurity professionals at all stages of their careers.”

“Information systems audit and control association's (isaca) primary purpose is to serve its members. One way isaca does that is by helping them do their jobs better, by offering them pragmatic guidance on emerging technologies they deal with every day. In 2015, fifteen white papers, three books and three sets of teaching materials were issued. Nearly 500 titles and nearly 200 downloadable items were available in the isaca bookstore. Isaca translated 330 items and publications into 22 non-english languages in 2015. Much of the research publications are offered to members for free download as a benefit of membership. Additionally, isaca developed the cybersecurity career roadmap, the first of its kind to facilitate an understanding of a professional's path within the cybersecurity workplace. Additionally, a career pathway infographic was developed for the csx web site to show the holistic journey of a cybersecurity professional. The association offers member benefits in the areas of professional development, community and leadership, and continually reviews and expands its portfolio of benefits to address the changing needs of members. Many member benefits are documented and further explained within the other responses on this form. As a result of this activity, isaca membership grew 2 percent from 1 january to 31 december 2015, growing to 124,357 members in 187 countries. Six new chapters were added, taking the total number of chapters worldwide to 213.”

“Information technology (IT) is a rapidly changing industry, and it demands a commitment on the part of its practitioners to learn continuously and master new skills. Certification is one way to expand one's skill set and be recognized for doing so. Holding an Information Systems Audit and Control Association (ISACA) professional certification demonstrates excellence in the topic and a commitment to remaining current and informed; it distinguishes an individual from his/her peers. Information Systems Audit and Control Association (ISACA) offers five certifications: Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified in the Governance of Enterprise IT (CGEIT), Certified in Risk and Information Systems Control (CRISC), and cybersecurity practitioner (csxp) designations. In 2015, CISA saw a 6.1 percent increase, growing to more than 121,000 certification earners by year's end, since its inception in 1978. The CISA exam was available in multiple languages at more than 250 locations. CISM, which was first offered in 2002, saw an 11.7 percent increase this year, growing to more than 30,000 certification earners by year's end. CGEIT was introduced in 2007, saw a 7.1 percent increase this year, growing to more than 6,700 certification earners by year's end. CRISC saw a 6.8 percent increase this year, growing to more than 19,500 certification earners by year's end, since its inception in 2010. csxp, isaca's newest certification was introduced in 2015. 2015 marked the ninth year the CISA and CISM certifications were accredited under international standard ANSI/ISO/IEC 17024 from the International Organization for Standardization (ISO), the fifth year CGEIT received that accreditation, and the third year that CRISC was so recognized.”

“In 2015, the Information Systems Audit and Control Association (ISACA) education roster included major face-to-face events such as the global Computer Audit, Control and Security (CACS) conferences; topic-specific conferences (on information security and risk management, and on governance, risk and compliance); and week-long training events focusing in-depth on one or two topics. ISACA is dedicated to monitoring the professional environment and developing new programs as needed to complement its established portfolio of events. The association has focused a considerable amount of effort on distance learning, as it provides a way to cover late-breaking topics on a timely basis and offer low-cost education to a globally dispersed audience. The online events program included quarterly webinar programs specific to geographical regions, including a Spanish language event in Latin America and an event in Europe/Africa. In 2015, ISACA launched the COBIT Conference in North America and Europe. The association also launched the first cybersecurity conference, CSX North America 2015, which sold out, paving the way for future expansion. ISACA's webinar program included 43 webinars on various topics, of which more than 37,000 attendees took advantage. Two virtual conferences hosted more than 6,000 participants. The Training Week program included 12 events presented in cooperation with Deloitte LLP. As valuable as distance learning is, the benefits of small-venue, face-to-face training continues to be appreciated. In 2015, ISACA provided 65 on-site training programs, an increase of more than 15 percent over last year, which enterprises used as a low-cost, customizable way to educate multiple employees at once.”

“Email Communication Services 97,723. Exam Development & Administration 2,710,491. Media/Public Relations Services 797,833. Other Professional Services 2,332,501. Recruiting/Placement Fees 169,429. Strategic consulting services 1,342,713. Temporary Clerical Services 45,592. Temporary Personnel Services 97,121. Translation Services 171,821.”

“The organization has a committee responsible for the oversight of the audit and the selection of the independent accountant.”