> Have an external firm that will try to break your systems This is by far the most important one, and in fact, I would argue that having external code or desi

> Have an external firm that will try to break your systems This is by far the most important one, and in fact, I would argue that having external code or design audit would be incredibly useful as well. I work in a regulated area and it is amazing how well we do the things that are audited compared to the things that are not. In fact, all our systems are neatly divided into those that get audited and those that don't specifically so that we can apply all our higher standards to the audited ones. It is also important to recognise how empowering it is especially for less senior staff to be able to reference an standard or guideline and the point out that a flaw is vulnerable to discovery by audit.