Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //

Compliance

Three Surefire Ways To Tick Off An Auditor

Avoid these common mistakes to improve your chances for a smooth compliance audit

Funny thing about auditors: They're not machines. They're people -- people who are capable of pet peeves and whose emotions can color the way they approach their work. So wouldn't it make sense for an organization to do everything in its power to keep auditors happy since they hold your organization's compliance success in their hands?

We're not talking bribes or home-baked cookies. We mean engaging in common professional courtesy and a state of readiness that will smooth the way for an easier encounter. The following are three ways that organizations fail to do this on a regular basis.

1. Putting On Airs
Nothing steams an auditor like an IT staffer who tries to use jargon as a weapon, says Glenn Phillips, president of Forte Inc., an audit firm that does IT security and HIPAA assessments.

"Many IT staff have learned that if they use big words or complicated technical language, management may leave them alone. It is also a means to show off how smart they are, and they may even learn to B.S. their way through things this way. After all, who will call them out?" Phillips says. "A good audit team won't fall for it and will know the language. But then management may be confused as to who to believe."

Not only does the baloney terminology and technical vagueness show the auditor there could be something the team is hiding, but it is also just plain insulting. Assuming the auditors don't have the technical mojo to keep up is a surefire way to hack them off.

"My biggest pet peeve as an IT auditor is when network administrators, developers, or any other positions that are more technical in nature attempt to undermine my technical knowledge. Because the developer assumes that I am technically inept, they think that they can give me a low-level answer [to] confuse me to believing that they know what they are talking about," says Andrew Weidenhamer, audit and compliance practice lead at SecureState. "Unfortunately for the developer, I used to be a penetration tester and used these types of vulnerabilities to break into organizations, which, in the end, simply makes the developer look silly."

2. Providing Poor Documentation
Auditing work is fueled by written information and paper trails. When an organization fails to document its activities or provide any sort of written proof of its claims, that's a guaranteed irritant.

"Lack of documentation is the biggest issue. When it comes to the auditors and when I see their reports, the biggest pet peeve they'll have is that the company had all of its policies, but it is stuck in Ed's head somewhere in the finance department or wherever," says Bob Gaines, security and compliance manager for All Covered. "The policy isn't written down anywhere."

[Security professionals need to consider these best practices and new compliance requirements as they ring in a new year. See 2012 Compliance Checklist.]

Similarly, the auditors don't want to have to fight you every step of the way to get the information they need. According to Jim Hurley, managing director of Symantec's IT Policy Compliance Group, "arguing with auditors about whether they really need the information they requested" will surely tick them off.

"This red-flag tells auditors there may be something hidden under the rocks, and auditors just love to turn over rocks," Hurley says.

3. Lying Or Misdirecting
Whether it is lying, remaining intentionally vague, or misdirecting, a lack of forthcoming attitude really sticks in the craw of any auditor in the field. As Weidenhamer puts it, it only delays the audit as the auditor starts to dig deeper for information.

"What the organization doesn’t understand is that any good auditor is going to do what is necessary to uncover what is needed for the audit. This is true even if this means talking to six more individuals or collecting 35 more pieces of evidence," he says. "Not being forthcoming can not only cost the organization more in the long run, but also further inconvenience organizational personnel as no one likes to be audited."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
TheRat
50%
50%
TheRat,
User Rank: Apprentice
1/18/2012 | 3:52:21 PM
re: Three Surefire Ways To Tick Off An Auditor
While the auditor cited in comment #1 may be technically proficient, many are not. I am an auditor and consultant, and was previously a SA who was audited regularly. The majority of auditors I have encountered (almost always from the Big Four) have a limited understanding of "how the things work," and rely on generic checklists created by others who have never been operational.

Documentation, as stated in the article, is the key.
Bprince
50%
50%
Bprince,
User Rank: Ninja
1/6/2012 | 11:15:13 PM
re: Three Surefire Ways To Tick Off An Auditor
@ readers: ever catch someone trying to cheat an audit? What were they doing and what was their excuse?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/7/2020
The Coronavirus & Cybersecurity: 3 Areas of Exploitation
Robert R. Ackerman Jr., Founder & Managing Director, Allegis Capital,  4/7/2020
'Unkillable' Android Malware App Continues to Infect Devices Worldwide
Jai Vijayan, Contributing Writer,  4/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Digitized COVID-19 Prevention
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-21034
PUBLISHED: 2020-04-09
In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.
CVE-2020-1895
PUBLISHED: 2020-04-09
A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affects versions prior to 128.0.0.26.128.
CVE-2020-5263
PUBLISHED: 2020-04-09
auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the er...
CVE-2020-9499
PUBLISHED: 2020-04-09
Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDNS test command, which may cause the device to go down.
CVE-2020-9500
PUBLISHED: 2020-04-09
Some products of Dahua have Denial of Service vulnerabilities. After the successful login of the legal account, the attacker sends a specific log query command, which may cause the device to go down.