Coming from a distant background in IT audit for a national accounting firm. Audit reports like SOX and SSAE 16 that tie back to financial risk can be more sta

Coming from a distant background in IT audit for a national accounting firm. Audit reports like SOX and SSAE 16 that tie back to financial risk can be more staid, because of the legal risk to both the auditor and auditee. Even though it appears to be tied to financial audit, we could still accomplish a lot on the infosec side because of the close relation between infosec failure and significant financial impact. Final reports contained a section specifically for the company's own statements, and a section for the auditor statements that was almost always boilerplate straight from legal. Flourish and marketing were nowhere to be found. As a former auditor I enjoy reading these reports but I always find myself asking: who are these "auditors" and how are they held accountable, besides not being invited back by the auditee? And: Have I ever seen such a report that concluded the product contained critical exceptions or findings that should discourage consumers from using the product? I can't think of any, maybe someone else can.