8 ms·

As the person responsible for IT I was audited in several companies by several of the large auditing firms. The people auditing IT had no clue what they were do

As the person responsible for IT I was audited in several companies by several of the large auditing firms. The people auditing IT had no clue what they were doing, no clue about IT and were just running a checklist. I could have told them whatever I liked.

jacquesm 6y ago
Yes, we hear this all the time. It's just kids with checklists who have absolutely no idea about the nature of the questions they are asking, why they are asking them and have absolutely no plan for off-script follow up questions based on the answers given. A lot of these auditors come from a financial background and they treat IT in much the same way, as if there is some kind of checksum they can calculate which will tell them if the company is healthy from an IT perspective or not. Companies that are certified tend to be very good at process but are sometimes surprisingly bad at the actual IT. But it's all documented perfectly.
- jacobr1 6y ago
  On the other hand, one of the benefits of all that documentation and policy is that blame can be assigned when the inevitable problems arise
  - jacquesm 6y ago
    The CYA component is definitely present.
exhilaration 6y ago
Similarly, I remember at my last job management would start talking about the "ISO corner" each year, where all the forms that we never, ever touched sat. This of course coincided with our ISO 9001 recertification. A few developers would be coached on what to say to the certifier, he'd be there for 2 days, and then we'd go back to business as usual.
- juskrey 6y ago
  By the way, ISO organization does not endorse, check or enforce compliance of any of the certification providers, and can't basically do anything against someone who just sells ISO certificates in shiny bevel, even if they wanted. That said, all the ISO standards are corporate moonspeak and bullshit themselves and do not bear any practical sense. (All that, for example, looong document on infosec ISO 27001 says is "try to be secure, my friend")
  - jacquesm 6y ago
    Mixed bag. ISO27001 when taken seriously and implemented throughout a company that means well and has the resources to do so will at least guarantee some level of process to be present. This then needs to be backed up with actual IT and security knowledge to be effective, and that is more often than not where the problems are. So as a rule we treat an ISO 27001 certificate not so much as a checkbox item meaning we can skip certain parts of our audit, but as a nice-to-have which may help speed up the interview process because we at least know what terminology to use. In practice there is too little difference between companies with or without such certification to see it as anything other than a marketing tool.
  - ajb 6y ago
    "all the ISO standards are corporate moonspeak" Bit of a generalisation there. ISO/IEC 13818-3 was quite useful, for example.
    - juskrey 6y ago
      Okok, I mean all that corporate/org standards.
arethuza 6y ago
My wife started her career as an internal auditor at a UK financial company - she was apparently repeatedly told to stop finding problems, her manager acknowledged that the things she was finding were real problems but nobody wanted to have formal reports describing them. She left after a colleague who apparently spent most of his time asleep in a cupboard got promoted over her....
- watertom 6y ago
  I hope she wasn't surprised. People who listen to their managers get promoted.
  - arethuza 6y ago
    I think being told not to find so many problems she could perhaps have coped with - having someone who was apparently unconscious most of the time promoted ahead of her was what really did it. NB It was financial auditing not IT.
    - jacquesm 6y ago
      Well, it is clear that he was promoted because he wasn't interested. It allowed the rest of the people there to get away with stuff that they shouldn't have been doing. Leaving was the best option that your wife had, in such a case you really don't want to stick around until the house burns down.
      - cutemonster 6y ago
        Is the point, from the company's point of view, to just have some people on its payroll with certain job titles, so looks fine to people outside? To make gov agencies happy? Or investors? -- who are those who care (And good if they do mostly nothing)
    - znpy 6y ago
      what's the legal liability in omitting a problem you've found during an audit? not for the auditing company, for the auditor.
bardworx 6y ago
I believe I can provide some color as my wife is an auditor and I work in IT. We’ve had this discussion before. Audit is really freaking expensive; Domain experts too. While there is a checklist that given to the auditor, the person asking those questions are usually senior or early manager level. The person has little experience in IT but usually has a small BS detector because of previous audits. That checklist is then sent to an internal domain expert to verify. Follow up questions may occur. Having said that, this is strictly for compliance and “covering your own butt”. This past year a firm was found negligent because they didn’t catch fraud because they simply “checked the box”. Since then, most firms have introduced rudimentary IT training for auditors responsible for said checklist. (All staff have to take the classes, when at level). TL;DR an auditor cannot have same knowledge as IT person and audit time is expensive. They’re trained to earmark fraud and to verify, to the best of their abilities, they are not signing off on a lie. Shit is hard and no system is perfect.
- jacquesm 6y ago
  This is spot on and one of the reasons why those reports are worth absolutely nothing other than that they might help close some deals.
  - bardworx 6y ago
    This isn't for "closing a deal" but because the audit co is signing off on financials. This is why in a companies public reporting, they have a section about possible damage from losing customer info. That's legalize for: 1. The Public Company being audited isn't going to spend money on a real technical audit and may in the future lose customer info, etc. 2. The financial auditing company doesn't have enough experience to properly asses the situation. They did the best they could but they're no experts.
    - jacquesm 6y ago
      Ah, yes, I still had ISO27001 in mind.
- the8472 6y ago
shaqham 6y ago
As a former IT auditor I can only confirm your statement. After I did my master in business administration with a touch of CS (it was called Master of Information, Media and Technology Management - and I really just learned basic Java, SAP, and one course about IT architecture) I got a job at a big four auditing company as an IT auditor. I was literally just going through some checklists and at that time I had no idea about the systems or technology I was auditing. After two years I got so frustrated with my job I decided to get a second degree in CS. The more I studied, the more obvious it became to me that someone with a CS degree never would do such boring work if there are other job opportunities in IT.
- jacquesm 6y ago
  So, as someone who spent a lifetime in IT, I actually enjoy the work. It gives me a way to give other companies, many more than I could normally work for, a way to benefit from that experience. Our little crew is composed of veteran IT people, all with lots of real world experience, we get the privilege of looking at lots of different companies, both the good and the bad. Which in turn gives us more knowledge. It is anything but boring to me.
  - shaqham 6y ago
    Glad to hear you enjoy your work. For me, it was just going through some checklists under enormous time pressure at large financial institutions and mostly alone, without any of my team members on site. If I were to do the job today, I might be able to look more into the details of the systems/applications I am auditing, immerse myself in them and have some meaningful conversations with the people I am auditing. Thank you for your perspective
rootsudo 6y ago
Very much true. I've had the pleasure of doing this stuff on both sides.
curiousllama 6y ago
As a former IT auditor, this checks out. Depending on the company, they may have just grabbed whoever was available.

jacquesm 6y ago

Yes, we hear this all the time. It's just kids with checklists who have absolutely no idea about the nature of the questions they are asking, why they are asking them and have absolutely no plan for off-script follow up questions based on the answers given. A lot of these auditors come from a financial background and they treat IT in much the same way, as if there is some kind of checksum they can calculate which will tell them if the company is healthy from an IT perspective or not. Companies that are certified tend to be very good at process but are sometimes surprisingly bad at the actual IT. But it's all documented perfectly.

jacobr1 6y ago
On the other hand, one of the benefits of all that documentation and policy is that blame can be assigned when the inevitable problems arise
- jacquesm 6y ago
  The CYA component is definitely present.

exhilaration 6y ago

Similarly, I remember at my last job management would start talking about the "ISO corner" each year, where all the forms that we never, ever touched sat. This of course coincided with our ISO 9001 recertification. A few developers would be coached on what to say to the certifier, he'd be there for 2 days, and then we'd go back to business as usual.

juskrey 6y ago
By the way, ISO organization does not endorse, check or enforce compliance of any of the certification providers, and can't basically do anything against someone who just sells ISO certificates in shiny bevel, even if they wanted. That said, all the ISO standards are corporate moonspeak and bullshit themselves and do not bear any practical sense. (All that, for example, looong document on infosec ISO 27001 says is "try to be secure, my friend")
- jacquesm 6y ago
  Mixed bag. ISO27001 when taken seriously and implemented throughout a company that means well and has the resources to do so will at least guarantee some level of process to be present. This then needs to be backed up with actual IT and security knowledge to be effective, and that is more often than not where the problems are. So as a rule we treat an ISO 27001 certificate not so much as a checkbox item meaning we can skip certain parts of our audit, but as a nice-to-have which may help speed up the interview process because we at least know what terminology to use. In practice there is too little difference between companies with or without such certification to see it as anything other than a marketing tool.
- ajb 6y ago
  "all the ISO standards are corporate moonspeak" Bit of a generalisation there. ISO/IEC 13818-3 was quite useful, for example.
  - juskrey 6y ago
    Okok, I mean all that corporate/org standards.

arethuza 6y ago

My wife started her career as an internal auditor at a UK financial company - she was apparently repeatedly told to stop finding problems, her manager acknowledged that the things she was finding were real problems but nobody wanted to have formal reports describing them. She left after a colleague who apparently spent most of his time asleep in a cupboard got promoted over her....

watertom 6y ago
I hope she wasn't surprised. People who listen to their managers get promoted.
- arethuza 6y ago
  I think being told not to find so many problems she could perhaps have coped with - having someone who was apparently unconscious most of the time promoted ahead of her was what really did it. NB It was financial auditing not IT.
  - jacquesm 6y ago
    Well, it is clear that he was promoted because he wasn't interested. It allowed the rest of the people there to get away with stuff that they shouldn't have been doing. Leaving was the best option that your wife had, in such a case you really don't want to stick around until the house burns down.
    - cutemonster 6y ago
      Is the point, from the company's point of view, to just have some people on its payroll with certain job titles, so looks fine to people outside? To make gov agencies happy? Or investors? -- who are those who care (And good if they do mostly nothing)
  - znpy 6y ago
    what's the legal liability in omitting a problem you've found during an audit? not for the auditing company, for the auditor.

bardworx 6y ago

I believe I can provide some color as my wife is an auditor and I work in IT. We’ve had this discussion before. Audit is really freaking expensive; Domain experts too. While there is a checklist that given to the auditor, the person asking those questions are usually senior or early manager level. The person has little experience in IT but usually has a small BS detector because of previous audits. That checklist is then sent to an internal domain expert to verify. Follow up questions may occur. Having said that, this is strictly for compliance and “covering your own butt”. This past year a firm was found negligent because they didn’t catch fraud because they simply “checked the box”. Since then, most firms have introduced rudimentary IT training for auditors responsible for said checklist. (All staff have to take the classes, when at level). TL;DR an auditor cannot have same knowledge as IT person and audit time is expensive. They’re trained to earmark fraud and to verify, to the best of their abilities, they are not signing off on a lie. Shit is hard and no system is perfect.

jacquesm 6y ago
This is spot on and one of the reasons why those reports are worth absolutely nothing other than that they might help close some deals.
- bardworx 6y ago
  This isn't for "closing a deal" but because the audit co is signing off on financials. This is why in a companies public reporting, they have a section about possible damage from losing customer info. That's legalize for: 1. The Public Company being audited isn't going to spend money on a real technical audit and may in the future lose customer info, etc. 2. The financial auditing company doesn't have enough experience to properly asses the situation. They did the best they could but they're no experts.
  - jacquesm 6y ago
    Ah, yes, I still had ISO27001 in mind.
the8472 6y ago

shaqham 6y ago

As a former IT auditor I can only confirm your statement. After I did my master in business administration with a touch of CS (it was called Master of Information, Media and Technology Management - and I really just learned basic Java, SAP, and one course about IT architecture) I got a job at a big four auditing company as an IT auditor. I was literally just going through some checklists and at that time I had no idea about the systems or technology I was auditing. After two years I got so frustrated with my job I decided to get a second degree in CS. The more I studied, the more obvious it became to me that someone with a CS degree never would do such boring work if there are other job opportunities in IT.

jacquesm 6y ago
So, as someone who spent a lifetime in IT, I actually enjoy the work. It gives me a way to give other companies, many more than I could normally work for, a way to benefit from that experience. Our little crew is composed of veteran IT people, all with lots of real world experience, we get the privilege of looking at lots of different companies, both the good and the bad. Which in turn gives us more knowledge. It is anything but boring to me.
- shaqham 6y ago
  Glad to hear you enjoy your work. For me, it was just going through some checklists under enormous time pressure at large financial institutions and mostly alone, without any of my team members on site. If I were to do the job today, I might be able to look more into the details of the systems/applications I am auditing, immerse myself in them and have some meaningful conversations with the people I am auditing. Thank you for your perspective

rootsudo 6y ago

Very much true. I've had the pleasure of doing this stuff on both sides.

curiousllama 6y ago

As a former IT auditor, this checks out. Depending on the company, they may have just grabbed whoever was available.