2 ms·

Same for security and audit processes. Most of these are a largely pointless waste of money and time. Some are well-intentioned, but utterly impractical to the

• isbvhodnvemrwvn 6y ago
  Not to mention many auditors have minimal understanding of the stuff they check on. On a number of occasions I had to explain how the system worked to the auditor, and what's worse - they seemed to be OK with me just explaining that, without any double-checking.
  • tlavoie 6y ago
    That's where they need better-educated, or more capable auditors. I used to do PCI auditing for organizations that handled credit card data. The course was a two-day joke, and they relied at the time on some stated level of prior experience. Clearly, the class was intended to give you knowledge of what's required, and how some processes worked, but you were expected to know the security stuff first. While I was not a huge fan of the organization, I was somewhat more satisfied when I could help the clients with reasonable analysis of their controls, and where they'd fall down (regardless of tick-box compliance.)