Some of the auditing staff sent in to check compliance of IT departments with corporate governance and regulatory standards frequently know little about IT, less about infrastructure and are gouging stretched budgets to deliver for a substandard result, according to a growing number senior IT professionals.
With compliance to corporate governance standards now mandated by law currently resulting in a shortage of skilled auditors with IT knowledge, one Australian bank CTO who spoke to Computerworld, on strict condition of anonymity, said the problem was now well and truly out of control.
"Compliance has now become a self-perpetuating industry and a law unto itself. What we are dealing with is an ever-expanding tribe of monkeys that just grows itself to fit the size [of the organisation it targets]. The 'final four' [large accountancy firms] are easily the worst; they just treat [financial services IT shops] as a blank cheque.
"With one firm, I've seen graduates straight from university who wouldn't know a piece of Cat 9 from what it's attached to. I could tell them my infrastructure is about to collapse and if it's not on a checklist they don't know what to write," the bank CTO said, adding that "You really have to wonder why the hell we are spending our money with these people."
Having locked horns with the Australian National Audit Office over the results of an IT audit in July, Department of Immigration, Multicultural and Indigenous Affairs CIO Cheryl Hannah told Computerworld that while IT auditors can certainly lift their game, organisations can avoid potential conflicts by intervening and educating auditors early in the process.
"There's obviously room for improvement. [You need to ensure auditors] take the time to understand the questions they need to ask, and the answers they get.
"It's right at the beginning that things get unstuck. I do think the level of understanding [of IT and business process] is low and there needs to be some level of partnership.
"People need to be sufficiently prepared before they undertake an audit," Hannah said.
Moreover, Hannah cautions that senior IT and business process managers need to stay alert to what issues may be coming down the audit pipeline.
"If you are not seeing [issues] that are mapping out there, they can come back and hit you in the back of the head. If you are just reactive [to new issues] you just get into strife. It can end up sounding like you are making excuses," Hannah said.