IS Audit Basics: Affect What Is Next Now

To celebrate its 15^th birthday, LinkedIn asked its members to share what they wanted to be when they were 15. Now, I do not know about you, but an auditor was not on my list, nor did I, or any of my friends, take turns at playing auditor and auditee! And yet, we became IT auditors. How did this happen? I certainly do not believe (at least, not entirely) that life is what happens to you when you are busy making other plans.¹ We are where we are because of a series of conscious decisions. The question now becomes how do we make conscious decisions to create, grow, improve and add value to our lives, our enterprises and the profession?

At EuroCACS 2016 in Dublin, Ireland, the closing keynote speech was given by futurist Mark Stevenson.² It was described by a colleague sitting next to me as the best talk he had ever heard. The talk centered on eight principles that Stevenson derived from traveling and working with successful optimists.³ That colleague, Martin Cullen, went on to read Stevenson’s book, so I tasked him to collaborate with me in reviewing the principles and their relevance to IT auditors.

Have an Unashamed Optimism of Ambition

Stevenson recommends not feeling embarrassed to say that things can be better. People should have no qualms about imagining an improved world and advocating for it, no matter how much derision they may receive at the hands of the cynical.⁴

This is not about the next promotion. This is about seeing that things in audit are not as they should be and they could be better. Those who believe this is the case should advocate for it in their enterprise. And those who are not sure how things can be better can reach out to their peers in the ISACA Online Forums.⁵

Engage in Projects That Are Bigger Than You

Philosopher Daniel Dennett⁶ says that an occupational hazard of his profession is being asked, “What is happiness?” The best definition he has come up with is to “find something more important than you are and dedicate your life to it.”⁷

There are many issues directly related to the adoption of new and innovative technologies in the world today. Examples range from the erosion of privacy to the lack of female representation in the industry. ISACA is a leading advocate in these areas with the introduction of its privacy principles,⁸ several documents around the EU General Data Protection Regulation (GDPR)⁹ and its SheLeadsTech¹⁰ program. Auditors who are passionate about these topics can do something about them by getting involved.

ISACA is always looking for volunteers,¹¹ and any ISACA employee will agree that it is the volunteers who make the organization what it is.

Ideas Are for Sharing, Not Protecting

Every new idea is, as Matt Ridley¹² suggests, the result of the joining together of two other ideas. Pragmatic optimists happily let their ideas meet and mingle with others.¹³

Back in my very first column in this space,¹⁴ I asked why, when we live in a world where it is very much a viable option to run a business using open-source software, we, as an ISACA community, do not develop open-source audit/assurance programs? To me, this is an idea waiting to meet someone else’s idea. Would it be possible, for example, to use GitHub¹⁵, Slack¹⁶ or ISACA’s Online Forums.¹⁷ I am not certain, but I believe it needs others’ ideas to help push it over the line.

I am also sure that everyone reading this column has ideas of their own. I would like to hear them. Only together can we truly move the IT audit profession forward.

Making Mistakes Is Okay, but Not Trying Is Irresponsible

As Ken Robinson¹⁸ pithily told the TED conference, “Being wrong is not the same as being creative, but if you’re not prepared to do anything wrong you’ll never do anything original.”¹⁹

We have all made mistakes during our careers and in audits. The key is to learn from them and not be afraid to try again. After every audit, each auditor should take some time to sit back and consider how it went. What went well? What mistakes were made? How could it be done better the next time? Audit-specific items should be documented and added to the audit file as there is every chance the auditor may be requested to audit this item again.

You Are Defined by What You Do, Not by What You Intend to Do

Pragmatic optimists are not interested in what others might do if they had more time or if their manager was more understanding or if they were the manager or if it was next week. People are what they do. That is it. Get on with it.²⁰

LinkedIn is full of conversations about the unimportance of certifications when compared to experience and, yes, there is no doubt that experience really counts. However, if people are defined by what they do, does not the fact that they have put in the effort to attain that certification say something about them? Lack of time is no excuse. Make time! Those who believe they have all the certifications they need can translate, write²¹ or review items.²² Exam Item Development Working Groups are composed based on geographical representation. Those who participate learn so much.

Be an Engineer

Engineers do not build bridges from a left-wing or right-wing perspective. They build bridges from an evidence-based perspective and, over time, bridge building gets better. Politicians make their decisions from an ideological perspective and, (in the opinion of many), over time, politics gets worse. No one should ignore politics, but those who choose engineering will do more.²³

This is key. Audit recommendations should be based on agreed criteria²⁴ and have the required evidence to back them up. If the evidence was obtained in an interview, it should be documented and the auditee sent a copy or a draft report produced in which the auditee is asked to confirm the auditor’s understanding.

As for politics, the auditor should remain sufficiently neutral to maintain independence while still being aware of how decisions are reached. That is, the auditor must understand who has the ability to make, ignore and overturn decisions; whether these are taken unilaterally or by consensus; and the degree to which they represent a compromise. Without such knowledge, the recommendations in the audit report may not be followed and the audit function could, consequentially, be discredited.²⁵

Be Prepared to Lose Nine Battles Out of 10

No one can win them all, but anyone is likely to win one battle out of 10. In “round two,” the auditor may win one battle out of nine and, by round three, one out of eight. By that time, the auditor will have created enough of a shift for the rest to follow. Those who worry about losing nine out of 10 will likely never enter the fray. It is useful to concentrate on winning the one. Overnight success is for the movies.²⁶

This is about winning the war, not the battle. All IT auditors have been here. They have identified a significant issue and, being conscientious and aware of the politics, they have reported the finding to management early only to be told at the exit interview that there is no issue or the issue has been resolved and should no longer be in the audit report.

My advice? If there is no compelling reason not to and it is possible to confirm that the risk has been addressed, the item should be removed. The auditor has done his or her job. The job is to help mitigate risk, not to have findings. Not only that, it has been accepted that the auditor’s recommended course of action was the correct one; this will work in his or her favor the next time a similar issue is found in another application. Furthermore, the auditor is building a relationship of trust with the auditee. This will be helpful the next time there is a finding that cannot be removed.

Kick Out Cynicism

Cynicism has become embedded in society and it is often seen as wisdom. yet there is nothing wise or even likeable about cynicism. For the cynic, everything is just a little too hard to imagine or do. As such, cynicism is both a recipe and an excuse for laziness. Auditors should have no time for it.²⁷

It can be very easy to become cynical and even have a sense of futility when working as an IT auditor. This is especially the case when finding the same issues across different applications and nothing ever seems to change. I urge IT auditors to avoid this and try to think differently. Could the applications be audited horizontally?²⁸ Could the issues be tackled from another angle? Remember culture, ethics and behavior of individuals and of the enterprise are very often underestimated as a success factor in governance and management activities.²⁹ Peers in ISACA’s Online Forums may be a good source of help in this area.³⁰

Conclusion

At the end of the day, if there is one guiding principle that encapsulates all these principles, it is, “Judge your worth not by what you own, but by what you create.”³¹ ISACA is the vehicle that allows IT auditors to learn and create. When I was 15, I was torn between IT and journalism. ISACA has enabled me to do both. Along the way, I feel I have created, I have grown and I have improved. This, in turn, has brought value to my enterprise. As it approaches its 50^th anniversary, ISACA can allow anyone reading this article to do more, too. Members can affect what is next, now. Pragmatic optimism tells us that the future is still a game worth playing and all players can make a difference.³²

Endnotes

¹ Lennon, J.; Beautiful Boy (Darling Boy), USA, 1980
² Stevenson, M.; “‘Reluctant Futurist’ Mark Stevenson Is an Author, Broadcaster and Expert on Global Trends and Innovation,” http://markstevenson.org/
³ Stevenson, M.; An Optimist’s Tour of the Future, Avery, USA, 2011, http://anoptimiststourofthefuture.com/
⁴ Stevenson, M.; “Eight Principles of Successful Optimists,” The Wall Street Journal, 20 March 2012, http://blogs.wsj.com/speakeasy/2012/03/20/eight-principles-of-successful-optimists/
⁵ ISACA Online Forums, Audit and Assurance, http://engage.v6pu.com/communities/onlineforums
⁶ Encyclopaedia Britannica, Daniel C. Dennett, http://www.britannica.com/biography/Daniel-C-Dennett
⁷ Op cit Stevenson 2012
⁸ ISACA, Privacy Principles and Program Management Guide, USA, 2016, http://store.v6pu.com/s/store#/store/browse/detail/a2S4w000004KoCREA0
⁹ ISACA, “General Data Protection Regulation (GDPR) Readiness, Assessment and Compliance,”
¹⁰ ISACA, SheLeadsTech, http://sheleadstech.v6pu.com/
¹¹ ISACA, Volunteer Opportunities, http://engage.v6pu.com/volunteeropportunities/about
¹² Ridley, M.; “When Ideas Have Sex,” TEDGlobal 2010
¹³ Op cit Stevenson 2012
¹⁴ Cooke, I.; “Audit Programs,” ISACA Journal, vol. 4, 2017, h04.v6pu.com/archives
¹⁵ GitHub, http://github.com/
¹⁶ Slack, http://slack.com/
¹⁷ ISACA Online Forums, http://engage.v6pu.com/communities/onlineforums
¹⁸ Robinson, K.; “Do Schools Kill Creativity?” TED2006, http://www.ted.com/talks/ken_robinson_says_schools_kill_creativity
¹⁹ Op cit Stevenson 2012
²⁰ Ibid.
²¹ Op cit ISACA, Volunteer Opportunities
²² ISACA, Committees, Working Groups, Advisory Councils and Other Volunteering Opportunities
²³ Op cit Stevenson 2012
²⁴ “Criteria” is defined as the standards and benchmarks used to measure and present the subject matter and against which an IS auditor evaluates the subject matter. ISACA, “ITAF: Information Technology Assurance Framework,”
²⁵ Gelbstein, E.; “The Soft Skills Challenge, Part 2,” ISACA Journal, vol. 3, 2015, h04.v6pu.com/archives
²⁶ Op cit Stevenson 2012
²⁷ Ibid.
²⁸ Cooke, I.; “Innovation in the IT Audit Process,” ISACA Journal, vol. 2, 2018, h04.v6pu.com/archives, figure 2
²⁹ ISACA, COBIT 5, USA, 2012, http://h04.v6pu.com/resources/cobit
³⁰ Op cit ISACA, Audit and Assurance
³¹ Op cit Stevenson 2012
³² Ibid.