4 ms·

I don't know how VW gets audited but in US, when a company is audited by their accounting firm, one of the sections is a "Process Audit" - checking to make sure

I don't know how VW gets audited but in US, when a company is audited by their accounting firm, one of the sections is a "Process Audit" - checking to make sure that regular business practices are followed. In a perfect world, audits would catch these things, however, because there is a lot of pressure on accounting firms, usually, this step isn't given a lot of consideration. In the event a company is caught, the accounting firm takes a hit on their reputation and have to go back, re-audit, and change their designation of company policy. Source: my wife works at one of the big 4 accounting firms and recently explained how an unrelated company had similar issues in failed business practices etc. etc.

jacquesm 11y ago
I think you hit the nail on the head with something that I've been wondering about for a while. I do audits (TDD) for a living and I actually take my job serious. I invest a lot of time into gathering all the information available on the company and try hard to figure out what the main issues facing a company are before I even go there. That means that when I go and look at a company I really look at it. This has two possible outcomes: the first is that the company is actually flattered that someone would take them - and their investors - serious enough to spend the time to make sure everything works and works well. They'll be proud to show someone that spent the time and effort to get to know their company and product how good they are at their jobs and how well their product is put together. If stuff surfaces that is not 'ok' they either know about it and have a plan of mitigation but simply not enough time or other resources and if they didn't know about it they're grateful for the sincere feedback and will fix things as soon as possible. The second possible outcome is that a lot of stuff surfaces that the people running the company may not even have been aware of and would rather not be aware of. This all in contrast to the same job being done by larger companies which tend to output super nice and glossy reports that are essentially 50% gray paper, there isn't anything you could do with a report like that except for pretending that you went through the motions of doing your job. My reports by contrast are usually 20% the size of the competition without any graphs or other distracting elements but are full of actionable advice and clear guide as to whether or not I believe the investment is a good one or not and why. This doesn't make me a whole lot of friends but the results are there and I stand by every word I write. For the life of me I can't imagine that VW with the budget they have and the amounts of money at stake would not give their compliance department the tools and the authority required to do their jobs. I'm still waiting for the other shoe to drop, someone leaking a mail archive from VW internal correspondence (assuming evidence has not been destroyed, which would make them look even worse) or something to that effect. This goes way beyond a single arm of VW, it just isn't possible and if it is then it is (counter-intuitively) actually worse for VW because it may mean they are not compliant with a whole bunch of other laws as well. In that case essentially any VW vehicle would need to be re-certified for all aspects of a road worthiness certification because they have make it plain that their compliance departments are toothless paper tigers. And that might be a much worse path for VW than the one where they simply and openly admit to malice with respect to this one single aspect of their products.
megablast 11y ago
Sure, and sometimes these audits are people asking the managers "do you do this?". That is all they do. They don't sit in and watch people.
- sithadmin 11y ago
  >sometimes these audits are people asking the managers "do you do this?". I work for one of the large pro services firms that does internal audit, compliance/risk projects, strategy consulting, etc. I'd argue that unless there are explicit sets of controls that HAVE to be tested as part of the project scope (which is usually defined by regulatory requirements), most audits are just people asking questions and ticking off boxes on a checklist. Most of the bigger firms even staff these projects with fresh graduates that often know absolutely nothing about what they're auditing.
  - jackgavigan 11y ago
    Conducting an audit doesn't necessarily mean that you check everything. Often, auditing is looking for evidence as to whether a particular procedure was followed or not. For example, say you're auditing a large company for compliance against a information security management system under ISO 27001, and you're checking to see whether the organisation you're auditing actually does keep its operating systems patched and its anti-virus software up to date. You'll certainly ask questions about whether, how and how often the updates are done but you're probably not going to check every single server, desktop and laptop because that would be too expensive. What you'll probably do is check a sample, and if all the devices in the sample are all up to date, you'll tick that box and move on. If, on the other hand, you find that half the desktops you check haven't been updated, then that's evidence that the updates policy isn't being followed, and would trigger further investigation, and probably a failure on that specific audit point. The equivalvent check in the VW case would be to run a test of the engine's emissions. It's not unreasonable for the methodology used to be based on that used by the regulatory body, in which case, it would have passed the audit.
    - sithadmin 11y ago

jacquesm 11y ago

I think you hit the nail on the head with something that I've been wondering about for a while. I do audits (TDD) for a living and I actually take my job serious. I invest a lot of time into gathering all the information available on the company and try hard to figure out what the main issues facing a company are before I even go there. That means that when I go and look at a company I really look at it. This has two possible outcomes: the first is that the company is actually flattered that someone would take them - and their investors - serious enough to spend the time to make sure everything works and works well. They'll be proud to show someone that spent the time and effort to get to know their company and product how good they are at their jobs and how well their product is put together. If stuff surfaces that is not 'ok' they either know about it and have a plan of mitigation but simply not enough time or other resources and if they didn't know about it they're grateful for the sincere feedback and will fix things as soon as possible. The second possible outcome is that a lot of stuff surfaces that the people running the company may not even have been aware of and would rather not be aware of. This all in contrast to the same job being done by larger companies which tend to output super nice and glossy reports that are essentially 50% gray paper, there isn't anything you could do with a report like that except for pretending that you went through the motions of doing your job. My reports by contrast are usually 20% the size of the competition without any graphs or other distracting elements but are full of actionable advice and clear guide as to whether or not I believe the investment is a good one or not and why. This doesn't make me a whole lot of friends but the results are there and I stand by every word I write. For the life of me I can't imagine that VW with the budget they have and the amounts of money at stake would not give their compliance department the tools and the authority required to do their jobs. I'm still waiting for the other shoe to drop, someone leaking a mail archive from VW internal correspondence (assuming evidence has not been destroyed, which would make them look even worse) or something to that effect. This goes way beyond a single arm of VW, it just isn't possible and if it is then it is (counter-intuitively) actually worse for VW because it may mean they are not compliant with a whole bunch of other laws as well. In that case essentially any VW vehicle would need to be re-certified for all aspects of a road worthiness certification because they have make it plain that their compliance departments are toothless paper tigers. And that might be a much worse path for VW than the one where they simply and openly admit to malice with respect to this one single aspect of their products.

megablast 11y ago

Sure, and sometimes these audits are people asking the managers "do you do this?". That is all they do. They don't sit in and watch people.

sithadmin 11y ago
>sometimes these audits are people asking the managers "do you do this?". I work for one of the large pro services firms that does internal audit, compliance/risk projects, strategy consulting, etc. I'd argue that unless there are explicit sets of controls that HAVE to be tested as part of the project scope (which is usually defined by regulatory requirements), most audits are just people asking questions and ticking off boxes on a checklist. Most of the bigger firms even staff these projects with fresh graduates that often know absolutely nothing about what they're auditing.
- jackgavigan 11y ago
  Conducting an audit doesn't necessarily mean that you check everything. Often, auditing is looking for evidence as to whether a particular procedure was followed or not. For example, say you're auditing a large company for compliance against a information security management system under ISO 27001, and you're checking to see whether the organisation you're auditing actually does keep its operating systems patched and its anti-virus software up to date. You'll certainly ask questions about whether, how and how often the updates are done but you're probably not going to check every single server, desktop and laptop because that would be too expensive. What you'll probably do is check a sample, and if all the devices in the sample are all up to date, you'll tick that box and move on. If, on the other hand, you find that half the desktops you check haven't been updated, then that's evidence that the updates policy isn't being followed, and would trigger further investigation, and probably a failure on that specific audit point. The equivalvent check in the VW case would be to run a test of the engine's emissions. It's not unreasonable for the methodology used to be based on that used by the regulatory body, in which case, it would have passed the audit.
  - sithadmin 11y ago