I do other audits, mostly safety and environmental, and my big question is usually “nobody made you write this, why would you write this down if you don’t want to do it?”
For most regulations, the laws and rules say something like “companies must ensure X doesn’t happen”, and the companies themselves have to come up with a way to do that.
Let’s say the law says “companies that transport apples must be able to show which batch went where”.
Company A says “to comply with the law, whenever we move a shipment, we store the shipping order on our computers”
Company B says “to comply with the law, the truckdriver will film the place they left, count the apples when leaving, then email the entire dashcam trip, and count the apples on arrival”.
Neither process is wrong, they both follow the law. But when I go to Company B, I promise you they’re going to fail the audit. They’re (probably) not doing anything illegal, but they’re going to fail their audit because no truckdriver is going to count a truck full of apples.
They made that rule, and they really didn’t have to.
there are 2 types of rules, or controls as we call it: Legal requirements and internal policies. The first one is clear there are legal requirements in place and you have to be in compliance with. The second one is where I get the most wtfs.
Internal policies are rules the company itself crated and said had to be followed. For example let’s say you are the IT manager of your company and you discover that everyones password to you system is 1234. You go out and look for market best practices and create a policy saying “All passwords must contain 6 numbers and 2 letters”. For this to be official you write it down and “publish” it internally.
Now, me as an auditor go there, look at the rule you created and check if it’s really in place or if you just wrote because. A lot of times it’s not. The company creates the rule but forgets or just postpone implementing it
Mostly cybersecurity strugles. If you invest millons in a castle with a gigantic lock and a pit full of piranas, would you leave the service entrance open and give everyone in town the key? Yeah, more commom than not.
But an IT audit is only necessary if your company goes public or is the owner wants it, maybe if you are a tech company.
I’m an IT auditor. “What the fuck?” is the main question, we ask it daily
I do other audits, mostly safety and environmental, and my big question is usually “nobody made you write this, why would you write this down if you don’t want to do it?”
Oh so so much of "dude you mande this rule up, you reviewd this document, why is this process nothing like this?!
Can you explain? Are you referring to catching people doing stuff they shouldn’t have been doing?
For most regulations, the laws and rules say something like “companies must ensure X doesn’t happen”, and the companies themselves have to come up with a way to do that.
Let’s say the law says “companies that transport apples must be able to show which batch went where”.
Company A says “to comply with the law, whenever we move a shipment, we store the shipping order on our computers”
Company B says “to comply with the law, the truckdriver will film the place they left, count the apples when leaving, then email the entire dashcam trip, and count the apples on arrival”.
Neither process is wrong, they both follow the law. But when I go to Company B, I promise you they’re going to fail the audit. They’re (probably) not doing anything illegal, but they’re going to fail their audit because no truckdriver is going to count a truck full of apples.
They made that rule, and they really didn’t have to.
there are 2 types of rules, or controls as we call it: Legal requirements and internal policies. The first one is clear there are legal requirements in place and you have to be in compliance with. The second one is where I get the most wtfs. Internal policies are rules the company itself crated and said had to be followed. For example let’s say you are the IT manager of your company and you discover that everyones password to you system is 1234. You go out and look for market best practices and create a policy saying “All passwords must contain 6 numbers and 2 letters”. For this to be official you write it down and “publish” it internally.
Now, me as an auditor go there, look at the rule you created and check if it’s really in place or if you just wrote because. A lot of times it’s not. The company creates the rule but forgets or just postpone implementing it
I work in IT and haven’t had to go through an audit yet knocks wood
Any war stories you can share?
Mostly cybersecurity strugles. If you invest millons in a castle with a gigantic lock and a pit full of piranas, would you leave the service entrance open and give everyone in town the key? Yeah, more commom than not.
But an IT audit is only necessary if your company goes public or is the owner wants it, maybe if you are a tech company.
It’d be interesting to see that answered scientifically.