Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //


Three Surefire Ways To Tick Off An Auditor

Avoid these common mistakes to improve your chances for a smooth compliance audit

Funny thing about auditors: They're not machines. They're people -- people who are capable of pet peeves and whose emotions can color the way they approach their work. So wouldn't it make sense for an organization to do everything in its power to keep auditors happy since they hold your organization's compliance success in their hands?

We're not talking bribes or home-baked cookies. We mean engaging in common professional courtesy and a state of readiness that will smooth the way for an easier encounter. The following are three ways that organizations fail to do this on a regular basis.

1. Putting On Airs
Nothing steams an auditor like an IT staffer who tries to use jargon as a weapon, says Glenn Phillips, president of Forte Inc., an audit firm that does IT security and HIPAA assessments.

"Many IT staff have learned that if they use big words or complicated technical language, management may leave them alone. It is also a means to show off how smart they are, and they may even learn to B.S. their way through things this way. After all, who will call them out?" Phillips says. "A good audit team won't fall for it and will know the language. But then management may be confused as to who to believe."

Not only does the baloney terminology and technical vagueness show the auditor there could be something the team is hiding, but it is also just plain insulting. Assuming the auditors don't have the technical mojo to keep up is a surefire way to hack them off.

"My biggest pet peeve as an IT auditor is when network administrators, developers, or any other positions that are more technical in nature attempt to undermine my technical knowledge. Because the developer assumes that I am technically inept, they think that they can give me a low-level answer [to] confuse me to believing that they know what they are talking about," says Andrew Weidenhamer, audit and compliance practice lead at SecureState. "Unfortunately for the developer, I used to be a penetration tester and used these types of vulnerabilities to break into organizations, which, in the end, simply makes the developer look silly."

2. Providing Poor Documentation
Auditing work is fueled by written information and paper trails. When an organization fails to document its activities or provide any sort of written proof of its claims, that's a guaranteed irritant.

"Lack of documentation is the biggest issue. When it comes to the auditors and when I see their reports, the biggest pet peeve they'll have is that the company had all of its policies, but it is stuck in Ed's head somewhere in the finance department or wherever," says Bob Gaines, security and compliance manager for All Covered. "The policy isn't written down anywhere."

[Security professionals need to consider these best practices and new compliance requirements as they ring in a new year. See 2012 Compliance Checklist.]

Similarly, the auditors don't want to have to fight you every step of the way to get the information they need. According to Jim Hurley, managing director of Symantec's IT Policy Compliance Group, "arguing with auditors about whether they really need the information they requested" will surely tick them off.

"This red-flag tells auditors there may be something hidden under the rocks, and auditors just love to turn over rocks," Hurley says.

3. Lying Or Misdirecting
Whether it is lying, remaining intentionally vague, or misdirecting, a lack of forthcoming attitude really sticks in the craw of any auditor in the field. As Weidenhamer puts it, it only delays the audit as the auditor starts to dig deeper for information.

"What the organization doesn’t understand is that any good auditor is going to do what is necessary to uncover what is needed for the audit. This is true even if this means talking to six more individuals or collecting 35 more pieces of evidence," he says. "Not being forthcoming can not only cost the organization more in the long run, but also further inconvenience organizational personnel as no one likes to be audited."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
1/18/2012 | 3:52:21 PM
re: Three Surefire Ways To Tick Off An Auditor
While the auditor cited in comment #1 may be technically proficient, many are not. I am an auditor and consultant, and was previously a SA who was audited regularly. The majority of auditors I have encountered (almost always from the Big Four) have a limited understanding of "how the things work," and rely on generic checklists created by others who have never been operational.

Documentation, as stated in the article, is the key.
User Rank: Ninja
1/6/2012 | 11:15:13 PM
re: Three Surefire Ways To Tick Off An Auditor
@ readers: ever catch someone trying to cheat an audit? What were they doing and what was their excuse?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-04-06
An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa.
PUBLISHED: 2020-04-05
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make gf_isom_box_del calls. This leads to various use-after-free outcomes involving mdia_Read, gf_isom_delete_movie, and gf_isom_parse_m...
PUBLISHED: 2020-04-05
PRTG Network Monitor before allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.
PUBLISHED: 2020-04-05
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
PUBLISHED: 2020-04-04
3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the <KEY>MYKEY</KEY> substring.