Javed Peeran, CPA, CISA, CISM, CDPSE, CCSE, MBA

Most professional biographies list credentials and leave the reader to guess what they mean. This one sets out what each period of work actually taught, because that is the part that determines whether someone can help you.

The practice

Javed Peeran CPA is a licensed certified public accounting practice at 11843 Nightingale Street, Moorpark, CA 93021, serving clients across Ventura County and Los Angeles County. The firm has served Los Angeles businesses since 1986, individual taxpayers, insurance companies, banks, mortgage companies, technology companies and semiconductor manufacturers.

It is deliberately structured as a single-principal practice. The person who scopes an engagement performs it and signs it. That is a genuine constraint on capacity, and it is the reason the practice declines work that requires a standing team across several offices.

Twenty years auditing financial institutions

The first long phase was external audit of banks, insurance companies and mortgage companies. Financial services is a demanding environment to learn in because the regulatory expectations are prescriptive and the examiners are specific. FFIEC IT examination requirements, GLBA safeguards obligations, third-party and vendor management programmes, business continuity, and the controls over core banking, loan origination and claims systems.

What that period taught, more than any framework, was what an examiner or an auditor actually opens first; which is consistently narrower and more particular than published guidance suggests. It is also where the habit of asking for evidence rather than accepting description was formed, and that habit shapes every assessment performed here.

Fifteen years as CFO and Corporate Controller

The second phase was inside technology companies rather than outside them, closing the books, building the reporting, managing the lenders and auditors, and living with the consequences of decisions made under a quarter-end deadline.

This is the experience that changes how advice is given. It is straightforward to recommend a control from the outside. It is different to have been the person who had to implement it while also closing the month with a team that was already stretched. Recommendations here are sequenced against what a finance function can realistically absorb, because the alternative (a beautifully designed programme that nobody has capacity to operate) is a familiar and expensive failure.

That period also included migrating legacy accounting systems to Oracle E-Business Suite across General Ledger, Accounts Receivable, Accounts Payable, Inventory and Fixed Assets, with the data reconciliation and cleansing that consumes most of the real effort in any ERP programme.

IT governance, security and privacy

The third strand runs alongside both: SOX and IT audit execution across the frameworks that govern how systems and data are controlled (ISO 27001 and 27002, SOC 1 and SOC 2, FISMA, FedRAMP, PCI DSS, CCPA, GDPR, HITECH and HIPAA) together with cloud security engineering and compliance strategy for both commercial and federal requirements.

More recently that has extended to automated security solutions for continuous monitoring, and to the use of generative AI for audit automation. The position taken on AI is deliberately narrow: it reduces the cost of finding things by a large factor and changes the process of concluding about them not at all. That argument is set out in full in the article on AI agents in continuous audit.

Credentials, and what each is for

• CPA, licensed by the California Board of Accountancy. The licence that permits audit, review and attestation work. Without it, no firm can issue a SOC report or an audit opinion, whatever else it can do.
• CISA. Certified Information Systems Auditor (ISACA). IT audit and control testing: access, change management, operations.
• CISM. Certified Information Security Manager (ISACA). Security programme governance rather than security operations.
• CDPSE. Certified Data Privacy Solutions Engineer (ISACA). The technical implementation of privacy obligations, which is where CCPA and GDPR stop being legal questions.
• CCSE. Certified Cloud Security Engineer. Cloud security architecture across the major platforms.
• MBA, the commercial framing that keeps a technical finding connected to what it costs the business.

How the work is approached

Say what the requirement actually is. A meaningful share of first conversations end with a client commissioning less than they intended, a review rather than an audit, a segregation of duties fix rather than a risk programme. That is the correct outcome and it is worth more than the fee foregone.

Rank findings by consequence. A hundred-page report listing every deviation is not a deliverable, it is an abdication. Twelve findings ordered by what they would actually cost, each with an owner and a date, is something a management team can act on.

State the independence position first. Where attestation and advisory cannot both be performed, that is settled in writing before an engagement letter exists rather than discovered halfway through a year.

Build for handover. Documentation the client's team can maintain, and training so they can. An engagement that creates a permanent dependency was designed badly.

Writing and executive education

Every article on this site is written personally, no ghostwriters and no syndicated content. The books and executive education page covers board briefings and executive workshops on governance, cybersecurity oversight and AI risk, and the Insights section holds the published writing.