CIOs critical of auditors' meddling
Some of the auditing staff sent in to check compliance of IT departments with corporate governance and regulatory standards frequently know little about IT, less about infrastructure and are gouging stretched budgets to deliver for a substandard result, according to a growing number senior IT professionals.
With compliance to corporate governance standards now mandated by law currently resulting in a shortage of skilled auditors with IT knowledge, one Australian bank chief technology officer (CTO) who spoke to Computerworld, on strict condition of anonymity, said the problem was now well and truly out of control.
"Compliance has now become a self-perpetuating industry and a law unto itself. What we are dealing with is an ever-expanding tribe of monkeys that just grows itself to fit the size (of the organization it targets). The 'final four' (large accountancy firms) are easily the worst; they just treat (financial services IT shops) as a blank check.
"With one firm, I've seen graduates straight from university who wouldn't know a piece of Cat 9 from what it's attached to. I could tell them my infrastructure is about to collapse and if it's not on a checklist they don't know what to write," the bank CTO said, adding that "You really have to wonder why the hell we are spending our money with these people."
Having locked horns with the Australian National Audit Office over the results of an IT audit in July, Department of Immigration, Multicultural and Indigenous Affairs CIO Cheryl Hannah told Computerworld that while IT auditors can certainly lift their game, organizations can avoid potential conflicts by intervening and educating auditors early in the process.
"There's obviously room for improvement. (You need to ensure auditors) take the time to understand the questions they need to ask, and the answers they get.
"It's right at the beginning that things get unstuck. I do think the level of understanding (of IT and business process) is low and there needs to be some level of partnership.
"People need to be sufficiently prepared before they undertake an audit," Hannah said.
Moreover, Hannah cautions that senior IT and business process managers need to stay alert to what issues may be coming down the audit pipeline.
"If you are not seeing (issues) that are mapping out there, they can come back and hit you in the back of the head. If you are just reactive (to new issues) you just get into strife. It can end up sounding like you are making excuses," Hannah said.
» posted by abennett
Computerworld Today
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
Esther Schindler
If the comments are ugly, the code is ugly
claird
SVG a graphics format for 21st century
pasmith
Take Chrome OS for a test spin
Sandra Henry-Stocker
Solaris Tip: Have Your Files Changed Since Installation?
jfruh
Android fragments vs. the iPhone monolith
mikelgan
What Gizmodo missed about the Pro WX Wireless USB disk drive
Where Google Chrome security fails: the password
I heard mention that the Chrome OS will have some sort of encryption available a la bitlocker. If it's possible to encrypt personal data using another password or key, then it may have potential for very secure data.... And Ubuntu has an 'encrypt home directory' option, perhaps google should follow suit.
- Dann
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.













