3 ms·

I came across a top tier compliance auditor doing the same thing recently. I tried to talk to them about it and rather than approaching this from a constructive

I came across a top tier compliance auditor doing the same thing recently. I tried to talk to them about it and rather than approaching this from a constructive point of view they wanted to know the name of the company that got certified so they could decertify them and essentially asked me to break my NDA. That wasn't going to happen, I wanted to have a far more structural conversation about this and how they probably ended up missing some major items (such as: having non-technical auditors). They weren't interested. They were not at all interested in improving their processes, they were only interested in protecting their reputation. I'm seriously disgusted about this because this was one of the very few auditors that we held in pretty high esteem. Pay-to-play is all too common, and I think that there is a baked in conflict of interest in the whole model.

vasco 7mo ago
It's auditing, nobody that is good at doing anything goes to auditing, unfortunately its one of those jobs. I haven't interacted with any auditor that actually understood all they were auditing, some are better than others but the average is worse than almost any other job description I have dealt with.
- bob1029 7mo ago
  You should check out the banking industry sometime if you'd like to interact with a competent auditor. Compliance gets taken quite seriously in an industry where one of your principal regulatory bodies has the power to unilaterally absorb your business and defenestrate your entire leadership team in the middle of the night.
  - jacquesm 7mo ago
    They could. But they don't. I've seen this up close. The regulatory bodies as a rule are understaffed, overworked and underpaid. I'm sure they'd love to do a much better job but the reality is that there are just too many ways to give them busywork allowing the real crap to go unnoticed until it is (much) too late.
    - close04 7mo ago
      Because they’re put there as a box ticking exercise without ever being given the power or resources to be able to do damage or negatively impact the bottom line of the big rule breakers. It’s just supposed to maintain the appearance of doing something without ever supporting these activities for real. For the most part they are a true Potemkin village. If the risk is diffuse (just some average Joe suckers will lose money) I wouldn’t hold my breath that anyone is controlling for real.
      - jacquesm 7mo ago
        I hate to say this but I suspect you are right.
  - soc2fraud 7mo ago
    Usually on a Friday night. If you see a bunch of rental cars hanging out near a bank HQ on a Friday afternoon, get all your money out before the doors close. FDIC is about to wreck shop.
    - maxbond 7mo ago
      They do it on a Friday so they can work through the weekend and reopen the bank on Monday as a branch of a different bank which is solvent, so I wouldn't worry too much. I'd be more worried about putting my money in a fintech not regulated by FDIC or NCUA (though many contract with a "real" bank so that your money is still protected).
      - soc2fraud 6mo ago
        That’s fine for your checking account which FDIC likely covers. But if they merge it into another bank and you have a payroll account there with 2MM sitting in it, you can have a real problem. People use JPMC, with all its fees, for a reason.
- arianvanp 7mo ago
  If you care about this stuff you need to in-house auditing and do your own audits with people who care. Then get certified by an external auditor for the paper. You can start very lightweight with doing spec driven development with the help of AI if you're at a size where you can't afford that. It's better than nothing. But the important part is you, as a company, should inherently care. If you rely on an auditor feedback loop to get compliant you've already lost.
  - disgruntledphd2 7mo ago
    This function exists in every publicly traded public company, and is called internal audit. It has the potential to be incredibly impactful, but often devolves into box ticking (like many compliance functions). And it's really hard to find technical people to do the work, as it's generally perceived as a cost centre so tends not to get budget.
    - ownagefool 7mo ago
      Nobody really tries to get technical people to do the work. Like cool, it's a great idea and would potentially produce positive results if done well, but the roles pay half the engineering roles, and the interviews are stacked towards compliance frameworks. There's very little ability to fix a large public company when HR is involved
      - disgruntledphd2 7mo ago
        Speaking as a technical (data) person currently working in internal audit for a not quite public company, it's not entirely uncommon. I do agree that the pay isn't great, but it's the fact that it's considered a cost centre that's been the issue for me.
        jacquesm 7mo ago
        Everything except for sales tends to be seen as a cost centre. It's ridiculous.
- deleted 7mo ago
  [deleted]
- TheOtherHobbes 7mo ago
  The industry is paid to provide a fig leaf for shady practices. Everyone knows what's going on, no one is going to do anything about it unless governments step in and give regulators more resources and more teeth, and "errors" lead to prosecutions and jail time. None of those are likely. This is the industry that missed Enron, WorldCom, Wirecard, Lehman, and many others.
  - noir_lord 7mo ago
    I suspect many AI startups will be on that list in 2-5 years.
  - jacquesm 7mo ago
    > Wirecard Don't get me started. That hasn't even properly ended yet, the fall-out is continuing to today.
dmos62 7mo ago
Have you considered whistleblowing?
- jacquesm 7mo ago
  Yes. But I'm not working at either company and I'm 99.9% sure that it would lead to absolutely nothing other than a lot of misery for myself. The NDA's I sign have some pretty stiff penalties attached. I was actually hoping to see my trust in the auditing company confirmed and I'm still more than a little bit annoyed that they did not respond in a more constructive way. My response however is a simple one: I used to steer (a lot of) business their way and I have stopped doing that.
  - maxbond 7mo ago
    Wouldn't it require a huge leap of faith for them to admit the audit was improper in order to have that discussion? Who's to say you aren't recording?
    - jacquesm 7mo ago
      I've already established that it was improper. It's up to them to make the most of that knowledge and then to determine of this is a singleton or an example of a class that has more representation. In that sense it is free to them, I'm under absolutely no obligation to provide them with a service. But I'm willing to expend the time and effort required to get them to make the most of it. What I'm not going to do is to allow them to play the blame game or 'shoot the messenger'.
      - maxbond 7mo ago
        I didn't mean it as a criticism, I think giving them the opportunity to improve and refusing to offer a scapegoat were both standup things to do. I'm just wondering if they were ever in a position to take that opportunity.
        7mo ago

vasco 7mo ago

It's auditing, nobody that is good at doing anything goes to auditing, unfortunately its one of those jobs. I haven't interacted with any auditor that actually understood all they were auditing, some are better than others but the average is worse than almost any other job description I have dealt with.

bob1029 7mo ago
You should check out the banking industry sometime if you'd like to interact with a competent auditor. Compliance gets taken quite seriously in an industry where one of your principal regulatory bodies has the power to unilaterally absorb your business and defenestrate your entire leadership team in the middle of the night.
- jacquesm 7mo ago
  They could. But they don't. I've seen this up close. The regulatory bodies as a rule are understaffed, overworked and underpaid. I'm sure they'd love to do a much better job but the reality is that there are just too many ways to give them busywork allowing the real crap to go unnoticed until it is (much) too late.
  - close04 7mo ago
    Because they’re put there as a box ticking exercise without ever being given the power or resources to be able to do damage or negatively impact the bottom line of the big rule breakers. It’s just supposed to maintain the appearance of doing something without ever supporting these activities for real. For the most part they are a true Potemkin village. If the risk is diffuse (just some average Joe suckers will lose money) I wouldn’t hold my breath that anyone is controlling for real.
    - jacquesm 7mo ago
      I hate to say this but I suspect you are right.
- soc2fraud 7mo ago
  Usually on a Friday night. If you see a bunch of rental cars hanging out near a bank HQ on a Friday afternoon, get all your money out before the doors close. FDIC is about to wreck shop.
  - maxbond 7mo ago
    They do it on a Friday so they can work through the weekend and reopen the bank on Monday as a branch of a different bank which is solvent, so I wouldn't worry too much. I'd be more worried about putting my money in a fintech not regulated by FDIC or NCUA (though many contract with a "real" bank so that your money is still protected).
    - soc2fraud 6mo ago
      That’s fine for your checking account which FDIC likely covers. But if they merge it into another bank and you have a payroll account there with 2MM sitting in it, you can have a real problem. People use JPMC, with all its fees, for a reason.
arianvanp 7mo ago
If you care about this stuff you need to in-house auditing and do your own audits with people who care. Then get certified by an external auditor for the paper. You can start very lightweight with doing spec driven development with the help of AI if you're at a size where you can't afford that. It's better than nothing. But the important part is you, as a company, should inherently care. If you rely on an auditor feedback loop to get compliant you've already lost.
- disgruntledphd2 7mo ago
  This function exists in every publicly traded public company, and is called internal audit. It has the potential to be incredibly impactful, but often devolves into box ticking (like many compliance functions). And it's really hard to find technical people to do the work, as it's generally perceived as a cost centre so tends not to get budget.
  - ownagefool 7mo ago
    Nobody really tries to get technical people to do the work. Like cool, it's a great idea and would potentially produce positive results if done well, but the roles pay half the engineering roles, and the interviews are stacked towards compliance frameworks. There's very little ability to fix a large public company when HR is involved
    - disgruntledphd2 7mo ago
      Speaking as a technical (data) person currently working in internal audit for a not quite public company, it's not entirely uncommon. I do agree that the pay isn't great, but it's the fact that it's considered a cost centre that's been the issue for me.
      - jacquesm 7mo ago
        Everything except for sales tends to be seen as a cost centre. It's ridiculous.
deleted 7mo ago
[deleted]
TheOtherHobbes 7mo ago
The industry is paid to provide a fig leaf for shady practices. Everyone knows what's going on, no one is going to do anything about it unless governments step in and give regulators more resources and more teeth, and "errors" lead to prosecutions and jail time. None of those are likely. This is the industry that missed Enron, WorldCom, Wirecard, Lehman, and many others.
- noir_lord 7mo ago
  I suspect many AI startups will be on that list in 2-5 years.
- jacquesm 7mo ago
  > Wirecard Don't get me started. That hasn't even properly ended yet, the fall-out is continuing to today.

dmos62 7mo ago

Have you considered whistleblowing?

jacquesm 7mo ago
Yes. But I'm not working at either company and I'm 99.9% sure that it would lead to absolutely nothing other than a lot of misery for myself. The NDA's I sign have some pretty stiff penalties attached. I was actually hoping to see my trust in the auditing company confirmed and I'm still more than a little bit annoyed that they did not respond in a more constructive way. My response however is a simple one: I used to steer (a lot of) business their way and I have stopped doing that.
- maxbond 7mo ago
  Wouldn't it require a huge leap of faith for them to admit the audit was improper in order to have that discussion? Who's to say you aren't recording?
  - jacquesm 7mo ago
    I've already established that it was improper. It's up to them to make the most of that knowledge and then to determine of this is a singleton or an example of a class that has more representation. In that sense it is free to them, I'm under absolutely no obligation to provide them with a service. But I'm willing to expend the time and effort required to get them to make the most of it. What I'm not going to do is to allow them to play the blame game or 'shoot the messenger'.
    - maxbond 7mo ago
      I didn't mean it as a criticism, I think giving them the opportunity to improve and refusing to offer a scapegoat were both standup things to do. I'm just wondering if they were ever in a position to take that opportunity.
      - 7mo ago