4 ms·

I believe I can provide some color as my wife is an auditor and I work in IT. We’ve had this discussion before. Audit is really freaking expensive; Domain expe

I believe I can provide some color as my wife is an auditor and I work in IT. We’ve had this discussion before. Audit is really freaking expensive; Domain experts too. While there is a checklist that given to the auditor, the person asking those questions are usually senior or early manager level. The person has little experience in IT but usually has a small BS detector because of previous audits. That checklist is then sent to an internal domain expert to verify. Follow up questions may occur. Having said that, this is strictly for compliance and “covering your own butt”. This past year a firm was found negligent because they didn’t catch fraud because they simply “checked the box”. Since then, most firms have introduced rudimentary IT training for auditors responsible for said checklist. (All staff have to take the classes, when at level). TL;DR an auditor cannot have same knowledge as IT person and audit time is expensive. They’re trained to earmark fraud and to verify, to the best of their abilities, they are not signing off on a lie. Shit is hard and no system is perfect.

jacquesm 6y ago
This is spot on and one of the reasons why those reports are worth absolutely nothing other than that they might help close some deals.
- bardworx 6y ago
  This isn't for "closing a deal" but because the audit co is signing off on financials. This is why in a companies public reporting, they have a section about possible damage from losing customer info. That's legalize for: 1. The Public Company being audited isn't going to spend money on a real technical audit and may in the future lose customer info, etc. 2. The financial auditing company doesn't have enough experience to properly asses the situation. They did the best they could but they're no experts.
  - jacquesm 6y ago
    Ah, yes, I still had ISO27001 in mind.
the8472 6y ago
> TL;DR an auditor cannot have same knowledge as IT person and audit time is expensive. Code audits and pentesting are a thing you can buy. But yes, they're even more expensive. Turns out security isn't considered valuable enough for most.
- jacquesm 6y ago
  That's exactly it. They're seen as an unneccesary cost because there are no real penalties for being compromised. Though this is fortunately changing, which has caused companies to begin to take this stuff more serious than in the past.
- vsareto 6y ago
  Pay boat loads for auditors vs. paying pittances for getting pwned a few times. It's no wonder, really.
- bardworx 6y ago
  Right, that's exactly why the audit company isn't signing off on code audit or pen testing. They can only sign off on a simple checklist, if a caveat is listed in the financial reporting. They have no proficiency or enough people who know what they're doing. The approach is to meet the lowest common denominator set by the SEC or is expected from investors.
- number6 6y ago
  I am an IT person, and I put this first, and Auditor for 27001. Wouldn't say that you can't bullshit me, cause who knows all. I go in and look at the absolute basics. Like is there a person responsible for Security? What are his responsibilities? In the last 12 Months is there anything documented that proofs that he did his job? If so did the management followed through on his findings? If not why? You can fake all of this. But at some point its easier to do the job than to fake it. Well at least this is what I hope...

jacquesm 6y ago

This is spot on and one of the reasons why those reports are worth absolutely nothing other than that they might help close some deals.

bardworx 6y ago
This isn't for "closing a deal" but because the audit co is signing off on financials. This is why in a companies public reporting, they have a section about possible damage from losing customer info. That's legalize for: 1. The Public Company being audited isn't going to spend money on a real technical audit and may in the future lose customer info, etc. 2. The financial auditing company doesn't have enough experience to properly asses the situation. They did the best they could but they're no experts.
- jacquesm 6y ago
  Ah, yes, I still had ISO27001 in mind.

the8472 6y ago

> TL;DR an auditor cannot have same knowledge as IT person and audit time is expensive. Code audits and pentesting are a thing you can buy. But yes, they're even more expensive. Turns out security isn't considered valuable enough for most.

jacquesm 6y ago
That's exactly it. They're seen as an unneccesary cost because there are no real penalties for being compromised. Though this is fortunately changing, which has caused companies to begin to take this stuff more serious than in the past.
vsareto 6y ago
Pay boat loads for auditors vs. paying pittances for getting pwned a few times. It's no wonder, really.
bardworx 6y ago
Right, that's exactly why the audit company isn't signing off on code audit or pen testing. They can only sign off on a simple checklist, if a caveat is listed in the financial reporting. They have no proficiency or enough people who know what they're doing. The approach is to meet the lowest common denominator set by the SEC or is expected from investors.
number6 6y ago
I am an IT person, and I put this first, and Auditor for 27001. Wouldn't say that you can't bullshit me, cause who knows all. I go in and look at the absolute basics. Like is there a person responsible for Security? What are his responsibilities? In the last 12 Months is there anything documented that proofs that he did his job? If so did the management followed through on his findings? If not why? You can fake all of this. But at some point its easier to do the job than to fake it. Well at least this is what I hope...