3 ms·
Not to mention many auditors have minimal understanding of the stuff they check on. On a number of occasions I had to explain how the system worked to the audit
by isbvhodnvemrwvn 6y ago
Not to mention many auditors have minimal understanding of the stuff they check on. On a number of occasions I had to explain how the system worked to the auditor, and what's worse - they seemed to be OK with me just explaining that, without any double-checking.
- tlavoie 6y agoThat's where they need better-educated, or more capable auditors. I used to do PCI auditing for organizations that handled credit card data. The course was a two-day joke, and they relied at the time on some stated level of prior experience. Clearly, the class was intended to give you knowledge of what's required, and how some processes worked, but you were expected to know the security stuff first. While I was not a huge fan of the organization, I was somewhat more satisfied when I could help the clients with reasonable analysis of their controls, and where they'd fall down (regardless of tick-box compliance.)