Auditorium

The irony of being an Auditor in IT is that the people who end up doing it are frequently blissfully ignorant of the details of what they are tasked with auditing. This is unavoidable in a fast-moving world of tech, where today’s tech was sometimes only invented this morning.

That means auditors are often reduced to grasping at known broad technical terms without necessarily understanding how, or even if, those terms still apply to what they are auditing.

This is a Catch-22 situation, since they would likely not be auditing if they were capable of creating what they are auditing.

Otherwise, they would be creating it, and be audited by someone else without the required skills to create it.

In the spirit of Best Practice, Auditing then becomes an exercise in making one size fit all, because that means the auditor can apply a template written by someone else. Usually in a past where the technology being audited today either didn’t exist or was completely different.

Best Practices always lag behind reality.

So do audit templates.

In the corporate world, this shows up as increasingly complex and restrictive layers of Best Practices that get cumulatively appended to products or processes, long after those practices have stopped serving any practical purpose.

Nobody asks the obvious questions:

• Why are we still doing this?
• What purpose does it serve today?
• Is it even possible or relevant for the current version of the technology?

Because nobody audits the auditors.

Or the audit trail.

Because there is no money in reducing bureaucracy - only in adding it.