I do other audits, mostly safety and environmental, and my big question is usually “nobody made you write this, why would you write this down if you don’t want to do it?”
For most regulations, the laws and rules say something like “companies must ensure X doesn’t happen”, and the companies themselves have to come up with a way to do that.
Let’s say the law says “companies that transport apples must be able to show which batch went where”.
Company A says “to comply with the law, whenever we move a shipment, we store the shipping order on our computers”
Company B says “to comply with the law, the truckdriver will film the place they left, count the apples when leaving, then email the entire dashcam trip, and count the apples on arrival”.
Neither process is wrong, they both follow the law. But when I go to Company B, I promise you they’re going to fail the audit. They’re (probably) not doing anything illegal, but they’re going to fail their audit because no truckdriver is going to count a truck full of apples.
They made that rule, and they really didn’t have to.
Mostly cybersecurity strugles. If you invest millons in a castle with a gigantic lock and a pit full of piranas, would you leave the service entrance open and give everyone in town the key? Yeah, more commom than not.
But an IT audit is only necessary if your company goes public or is the owner wants it, maybe if you are a tech company.
I’m an IT auditor. “What the fuck?” is the main question, we ask it daily
I do other audits, mostly safety and environmental, and my big question is usually “nobody made you write this, why would you write this down if you don’t want to do it?”
Oh so so much of "dude you mande this rule up, you reviewd this document, why is this process nothing like this?!
Can you explain? Are you referring to catching people doing stuff they shouldn’t have been doing?
For most regulations, the laws and rules say something like “companies must ensure X doesn’t happen”, and the companies themselves have to come up with a way to do that.
Let’s say the law says “companies that transport apples must be able to show which batch went where”.
Company A says “to comply with the law, whenever we move a shipment, we store the shipping order on our computers”
Company B says “to comply with the law, the truckdriver will film the place they left, count the apples when leaving, then email the entire dashcam trip, and count the apples on arrival”.
Neither process is wrong, they both follow the law. But when I go to Company B, I promise you they’re going to fail the audit. They’re (probably) not doing anything illegal, but they’re going to fail their audit because no truckdriver is going to count a truck full of apples.
They made that rule, and they really didn’t have to.
It’d be interesting to see that answered scientifically.
I work in IT and haven’t had to go through an audit yet knocks wood
Any war stories you can share?
Mostly cybersecurity strugles. If you invest millons in a castle with a gigantic lock and a pit full of piranas, would you leave the service entrance open and give everyone in town the key? Yeah, more commom than not.
But an IT audit is only necessary if your company goes public or is the owner wants it, maybe if you are a tech company.