Today's Audit Journal

WikiLeaks, Censorship and the Right to Publish

October 25, 2010 Joel C. Font, Governance, Risk and Compliance Professional 8 comments

: Image via Wikipedia

Readers to this blog know that back in October 2009 I wrote two articles commenting on the WikiLeaks organization. As an auditor having been exposed to ethical issues in corporate America, and having seen cases where transparency in practice does not always follow documented policies, I felt that WikiLeaks could serve a valuable role in the corporate world, simply by being the place where whistleblowers could expose their concerns without fear of reprisals, especially when they exhaust normal channels. Today, a year after having written those articles, I feel the same as I did then. But, in this article I will venture to share some political observations about the context in which the planned release of over 350,000 reports, dubbed ‘The Iraq War Logs’, documenting the war and occupation of Iraq from 1 January 2004 to 31 December 2009 is taking place. It is up to the reader to determine if any of my observations have future implications for their work in the corporate world.

Thinking about the WikiLeaks media extravaganza brought back memories of my childhood in Cuba, where there is no Freedom of the Press or Freedom of Speech and journalists are regularly jailed for criticizing the government or expressing dissent from the accepted socialist dogma. In places like Cuba, controlled by dictators or one party systems, the pursuit of the truth, the right to protect the identity of sources, the right to publish free of censorship and the ideals of transparency are often thought of as unachievable dreams. Because of my personal experiences regarding the value of speaking freely, and memories of the killing, jailing, intimidation, beatings and exile of relatives for the simple reason of “political disagreement,” my support for publishing the leaked Afghan war documents and now the Iraq War Logs may be a bit more complex than that held by the average person.

As an American citizen, with various family members currently and previously in the US military, I support 150% the sacrifices that our service members make on a daily basis. However, I do not hold similar admiration and trust for our political leaders and the political elites that (unfortunately) send our military men and women to war. The lies, cover-ups, corruption, greed and incompetence that have occurred during the last fifty years, from the Bay of Pigs, Vietnam, the Middle East, Latin America, and within our own borders in our inner cities, does not lead me to believe that this political culture (of the right or the left) can be trusted, especially when dealing with matters of life or death. It has become clear that there is a huge and growing socio/economic chasm in America, with those at the top of the pyramid no longer acting for the benefit of the society, but for their narrow selfish interests. Whether this happens by accident or as part of a conspiracy, does not matter. We have a political elite where its members spend their entire lives in “public office” with many of their children and grandchildren succeeding them to the same or similar offices. We have billionaires who live in 15 million dollar mansions who spend 35, 50, or 80 million dollars in political campaigns for offices that pay annual salaries of less than $250,000. And, they tell us they do it for the love of serving the poor and ensuring equality. We have a two party system monopoly that plays musical chairs getting its members elected by less than 50% of voting adults nationally, and less than 30% of voting adults in local or state elections. We have a media that repeatedly reports on the same politically correct subjects 24 hours a day, from the same ideological perspective and the same prejudices, by reporters that previously worked for or will work for, the very political or financial elites they are supposedly providing unbiased reporting and coverage on. Our multinationals conduct business all over the world and when cases of corruption surface, our guys are always found to be ethical and within the law, while the foreigners are almost always found to be guilty of all sorts of unethical, criminal and fraudulent acts. In the name of Globalization our companies ship millions of jobs and capital overseas, but do little to re-invest and create jobs at home, feeding a vicious circle of unemployment, poverty and social unrest. As the world’s leading superpower, we have no qualms in militarily intervening, threatening and destabilizing other countries when our political and financial elites decide that their arbitrary interests are threatened. So let there be no doubt, I love America, but I also see its wrinkles and warts. The America I see today, is not the America I believe our Founding Fathers conceived and wanted.

In this environment and in this day and age, our political elites tell us that it is dangerous to have WikiLeaks publish the leaked Iraq war documents, because it will disclose important secrets that may put the lives of our troops in danger. It is hard to believe this claim, since it has been used so many times before by the same political culture every time someone published or threatened to publish government wrongdoing. It was used with the Pentagon Papers and the Watergate leaks. What seems to be more credible is that the danger is to the political elites and not so much to our troops. The fear of showing the world and the American people the mistakes, incompetence, injustices, arrogance, bullying and waste perpetrated by our top level leaders and institutions is what is at the heart of this call to stop Wikileaks. If we were living in a totalitarian regime like Cuba or North Korea, this sort of reaction would be expected, but aren’t we in an open democratic society? What the political elites are telling us is that we have to accept a conditional version of Freedom of Speech, Freedom of the Press and Transparency in government. They are saying that we have Freedom of Speech only when it does not offend them, that we have Freedom of the Press only when it does not challenge mass media and commercial interests and we have Transparency in government only when the government tells us it’s OK, for our own good!

We hear that Wikileaks should be an exception to the rules used with other media outlets. That Freedom of the Press protections allotted to other publishers and information distributors should not be extended to it because it is an open forum of information provided by unanimous “uncontrolled” and “un-vetted” individuals from around the world who may harbor anti-American sentiments and that the organization may be influenced by our enemies. Doesn’t this claim then support the notion that the American mainstream media has legal protections because it subjects itself to a sophisticated form of censorship, indirectly in the hands of the political and financial elites who determine the financial viability and licensing of these media conglomerates? Doesn’t this in turn put into question the integrity and reliability of the information analyzed and distributed by the mainstream media? What does this do to the claim that there is no censorship in America?

In an unprecedented manner, the left and the right, Democrats and Republicans want to crush Wikileaks and its founder. No one is talking about the original reasons why Wikileaks was founded and what it set out to do. It was a simple attempt to provide an alternative vehicle to corporate level “Whistleblower” programs, that were seen by many as ineffective and flawed. The fact that people of all persuasions, from all over the world, jumped on the opportunity to share uncensored information via the platform is evidence of the pent-up hunger there was and there is for such a tool. The majority of early Wikileak releases were not from disgruntled ex intelligence agents or unhappy consultants informing on government covert operations. They were articles and confidential papers on corporate fraud, unethical business practices, exposes on dangerous products, corporate bribery, insider trading, multinational tax evasion, unfair labor practices, consumer safety and so forth. As a corporate whistleblowing tool, it took a while to take off, but when it did, it quickly became an irritant to many large global organizations. Wikileaks did not choose or tell a global audience what they should submit for distribution in its platform. The material was and is submitted at the will and following the motivation of whomever has something they want to submit. And, this is how politically charged information has made its way to Wikileaks, and how ‘The Iraq War Logs’ found their way to the platform. These politically charged releases have also created a perfect distraction away from the original goals and objectives of Wikileaks. That of becoming a global corporate whistleblowing vehicle. Now, these things are forgotten and when Wikileaks is brought up in conversation, we hear instead about spies, the Russians, the Chinese, the North Koreans, traitors and hacking. It is truly an interesting turn. The complexity and legitimacy of Wikileaks as a whistleblowing service has been transformed, by very smart and sophisticated media and political experts, into a very simple and primal concept. Wikileaks equals treason!

By diverting public opinion away from the original subject, the legitimate need for some form of global corporate whistleblower is postponed. The global tax dodgers are safe, details on dangerous environmental risks in parts of the world will remain unknown and those who fund the arms trade will continue to be nominated for Nobel Peace Prizes. However, the genie is out of the bottle. Even if the current Wikileaks is shut down and its founder jailed, what we are experiencing is a high profile confirmation that such a public service is needed. Future incarnations will be more sophisticated and will likely be designed to withstand the types of technical and legal attacks we have recently seen. The days of secrecy as we used to know it are over. In this age of Social Media, cameras in every Smart-phone, instant messaging and millions of blogs, the existence of a Wikileaks type of service is likely to have a deterring impact on the way irresponsible and/or corrupt politicians and corporate executives do business. And, that’s not a bad thing.

How to Submit a Leak to WikiLeaks (WikiHow)
MIT students helped WikiLeaks suspect, hacker says (cnn.com)
Janine R. Wedel: Shadow Elite: WikiLeaks: Irresponsible or Indispensable? (huffingtonpost.com)
Wikileaks’ Afghan War Diary: An FAQ (pcworld.com)
WikiLeaks guilty, at least morally: Robert Gates (reuters.com)
Karzai says WikiLeaks war logs endanger informants (cbc.ca)
The WikiLeaks Paradox (voices.allthingsd.com)
WikiLeaks founder lives the life of a wanted man (seattletimes.nwsource.com)
WikiLeaks releases Iraq war documents (v3.co.uk)
US defends Iraq record after WikiLeaks furor (newsinfo.inquirer.net)
Reactions to the WikiLeaks release of Iraq-war files (economist.com)

Categories: Corporate Governance, Fraud Investigations, IT Security, Market and Industry News, Media, Politics Tags: Cuba, Iraq War, Julian Assange, War in Afghanistan (2001–present), Whistleblower, WikiLeaks

Book Review: “Managing the Audit Function” by Michael P. Cangemi and Tommie Singleton

June 2, 2010 Joel C. Font, Governance, Risk and Compliance Professional 9 comments

: Image by calafellvalo via Flickr

Many Internal Audit directors and managers new to their positions sometimes find it difficult to focus on the basics that keep their departments working smoothly. Especially, when dealing with the challenges of a difficult economy and pressures from Audit Committees adjusting to new regulatory issues. To make matters worse, audit managers often juggle multiple projects at various locations with limited staffs and little direction or mentoring from “audit subject matter experts” who when needed are difficult to find. Obtaining timely assistance in these situations can be a challenge.

Subscribing to the hundreds of blogs, Twitter, Facebook, Linkedin and professional networking groups on the web helps, but after a time the inevitable “information overload” occurs and obtaining 120 opinions in 2 hours, each from unknown individuals of varying expertise, and based on assumptions ranging from accurate to insane, can actually hinder decision making. This is why I recently recommended to a new IT Audit Director experiencing this challenge, that he purchase “Managing the Audit Function” 3rd. Edition, written by Michael P. Cangemi and Tommie Singleton. This book’s 369 pages are an audit manager’s best friend, direct to the point and authoritative. The authors, both highly respected and experienced in the audit field, focus on the key elements needed to successfully manage an internal audit department and includes a wide range of forms, policies, guidelines, as well as reporting best practices and organizational / administrative procedures. In my opinion this is the type of book every internal audit library should have, benefiting both financial and IT audit managers.

Let me review the book in greater detail so you understand why I place so much value in it.

The book is divided into four parts with nine chapters, each thoroughly presented with real life examples focusing on the what, why and when. The first part provides an excellent background on the Fundamentals of the Internal Audit Function (for those who have not had the pleasure of reading Brink’s Modern Internal Auditing), covering auditing standards and the responsibilities of a corporate auditor. The chapters on Internal Controls is precise and covers Risk Assessment and Control Strategies, both of great importance given the current regulatory environment. This first part of the book also introduces the reader to the “Corporate Audit Department Procedures Manual” which is the tool used by the authors to bring into context each of the many forms and templates presented. At minimum, this book teaches the new audit director or manager how to prepare a high quality Audit Department Procedures Manual!

The second part of the book focuses on the management and administrative aspects of running a corporate audit department. Taking nothing for granted, the first chapter in this section starts with how an audit department should be organized, where it should be in the corporate structure, its charter, policies and personnel. A good amount of focus is given to the responsibilities, duties and roles of internal audit managers and the CAE, as well as their relationships with external auditors and regulators. An excellent section devoted to audit planning, scoping and implementing is also included (which is later expanded in part three), giving the new manager a quick snapshot of these subjects if they have not obtained it elsewhere. For me, the best chapter in this part of the book is the chapter on Personnel, Administration, and Recruiting, dealing with performance evaluations and overall staff development.

The third part of the book focuses on Technical Procedures. This part makes generous use of sample forms and templates, giving the reader a head start on the creation of these, when needed. The three chapters composing this part of the book are in my opinion, the best coverage of Audit Planning, Audit Performance and Audit Reporting I’ve seen in a book anywhere. A manager who understands these three chapters is qualified to lead any audit department without worry. The coverage on Materiality, Workpapers and Reports to Management and Audit Committees is magnificent. The authors cover the relevant GAAP, SEC and AICPA procedures, pronouncements and guidance related to these important issues with clarity and directness, making the material digestible and easy to follow (the book was written in 2003, so readers need to read up on all relevant updates to be current).

The last part of the book deals with the Long-Term Effectiveness of a corporate audit department, an area many new directors and managers do not focus on very well, because they tend to focus on the “here and now,” but impacts how others see them and measure their success. Here, the authors cover Corporate Governance issues, Quality Assurance, Continuous Improvement systems and Marketing the Audit Function. These discussions increase the awareness of the “marketing” process to new audit managers who need to sell themselves, as much as what they do, in order to succeed in the organization.

I will conclude this very positive review by saying that having this book is like having a well rounded and dependable subject matter expert in audit management at you disposal each and every time you need a quick answer. If you are a new audit director or audit manager, the book will save you countless hours of research time and frustrations.

To purchase “Managing the Internal Audit Function” visit Today’s Audit Journal’s Bookstore

Related articles by Zemanta

Overwhelmed by IT: Internal Audit Execs Agree Improving Tech Skills Is Top Concern, New Protiviti Research Shows (newswire.ca)
Calgary auditor faces scrutiny (calgaryherald.com)
CIPFA releases draft statement of principles for internal audit (accountancyage.com)
Internal Audit Leaders Share Strategies for Economic Recovery (eon.businesswire.com)

Categories: Audit, Book Review, Jobs, Training and Certifications Tags: Audit, Book Review, Internal audit, Internal Controls, Quality Assurance

Auditing Career: Dealing with Mentally Unstable Managers

April 29, 2010 Joel C. Font, Governance, Risk and Compliance Professional 29 comments

Image via Wikipedia

The subject of “mental stability” is a mine field that has kept Psychologists and Psychiatrists busy since Sigmund Freud first proposed to make the study of human behavior into a hard science. Today, the meaning of mental stability is still not well defined in the social sciences, so it is extremely difficult for those of us outside of those fields to discuss it, define it or pass judgment on it. However, like pornography, a lack of mental stability in people, specially in the workplace, is something most of us recognize when we see it. As auditors, many of us have had to deal with mentally unstable people at different times and at different levels of the corporate world, including those at executive levels tasked with making significant decisions for their organizations. The effects of mental illness often cause serious negative impacts on the departments and the people the sick individuals interact with. But, because mental illness is still a taboo subject in corporate America, these people remain in their high level posts “undiscovered” for years. As auditors we often hear about managers who constantly change their minds or have difficulties making up their minds for the simplest of things, or directors who have sleeping disorders and call their staff’s at 3:00 AM to criticize their peers or to brainstorm strategies without end. Or, the abusive vice-president who obtains pleasure from humiliating her staff in public, insults minorities with “indirect” comments and makes disgusting facial contortions when talking to junior employees. And, one I personally remember… the supervisor who reprimands his team for following the very procedures and policies he instituted a few months earlier. When the person with these types of instabilities is your boss, you have a problem.

I’ve written this article as a result of a discussion I recently held with a Psychologist who specializes in Organizational Psychology, and she pointed out to my amazement, that in corporate America it is better to be an alcoholic or drug addict than to have a mental disorder. In 2010, most personnel departments address employee and executive level addictions with a variety of solutions such as 12 step programs, psychotherapy, etc., but mental illness, because of the difficulty in “proving it” carries legal issues that scares the average personnel manager, and so it is awkwardly “ignored.” This process of ignoring the destructive behaviors of mentally unstable managers or executives often includes an “unofficial” gag around direct discussions on the behaviors of the individual, instead “politically correct” comments like, “you have to be extremely patient to work with Mike,” or “Helen is a little eccentric,” or “Herbert is impulsive and a little abrasive” are heard. At the end of the day folks like Mike, Helen and Herbert terrorize their staffs, ignore business controls, make a mockery of policies and procedures and create an atmosphere of tension that often damages a respectful and cooperative work environment. Worse than that, these individuals almost always chase away good talent and bring about unnecessary risk exposures to the entire company. All of these things have indirect impacts on the work of auditors. I am going to use the “How many controls are enough” example below, to bring the point home.

One of the most common questions asked of auditors is “how many controls do we really need?” The question is often a legitimate one, but it can also hide a myriad of other issues that have little to do with risk management, compliance and audit. Variations of the too many or too few question sometimes come from low level staffers looking to “reduce unnecessary work,” but at other times you hear it from business managers, before Risk Assessment work begins, explaining that “given the fact that we know what our weaknesses are, and we have good controls already, why should we bother evaluating controls and looking for new ones?” At other times you hear the classic given by over zealous project managers, “we only have 10 minutes to discuss each control, so lets get this over with quickly.” Then there is the direct comment: “This is all a waste of time and I don’t give a %$#@ about you, controls or the audit department.” Most of these excuses or arguments are not presented by mentally unstable people, but some are. When used by mentally unstable people, watch out because all hell breaks lose, and you find yourself in a swamp full of snakes.

Dealing with these challenges is an art most auditors need to perfect. How indeed should these questions be answered, especially to people who do not understand the basics of controls, compliance and risks we auditors carry in our heads. How can all these complex legalistic requirements be translated for people who do not care to understand them, or have no intellectual ability or lack the attention span to “get it” within the short periods of time allotted to the process? These are our normal challenges with “normal” people. The challenges when dealing with mentally unstable managers may be insurmountable. Clearly conveying the message in a professional manner doesn’t cut it. Preparing nice PowerPoint presentations doesn’t cut it. Speaking in a low tone when they are screaming and insulting you doesn’t cut it. What my Psychologist friend pointed out is that these folks are sick, and not misbehaving or involved in temporary tantrums. As untreated sick people, they often can not control what they are doing. If you do not accept this fact, you will hit your head against the wall trying to interact with them in ways that work for normal folks, but do not for the mentally unstable. You must also understand that these events are not your fault since most mental disorders start early in a person’s life, way before you had the unfortunate luck of stepping in the person’s path.

My Psychologist friend jokingly suggested that auditors receive training on how to interact with people suffering with Attention Deficit Disorders, bipolar disorders and in group dynamics in the corporate environment. A company’s culture is a very complex organism. Even the smallest places have complicated political and social layers (silos) that have nothing to do with the official roles and functions performed by individuals and shown in organizational charts. Decisions in organizations, anyone who is observant will confirm, are not always made based on logic, business reasoning, policies, controls, and/or the need to comply with external regulations. They are often made based on fear, anger, sexual attraction, insecurity, jealousy, greed, hate, prejudices and confusion. Because of these things, it is easy for mentally unstable people to “hide” in the open. In many organizations these behaviors are sheltered because those at the top benefit from that sort of culture. For example, a manager who regularly works 8:00 AM to 9:00 PM (without asking for extra compensation), keeps to himself, does not take well to change, drives his staff like cattle, but surpasses his quotas, may be highly “appreciated” by his superiors. In these types of organizations calls to perform, comply with and produce results based on COSO, CobiT, As-5, PCAOB, SOX, ITIL, etc… are ignored, stone walled, analyzed to death or “adjusted” to the point of non-recognition. So, answering the “why do we need these controls?” question can be tricky if you happen to be in the wrong organization or before an unstable manager. Reaching an “understanding” on the need for a dozen or less controls can drag-on for twelve to eighteen months, or more, easily. Usually, the conclusion of these torturous wasteful exercises is reached via discussions or negotiations that have little to do with the compliance, legal or operational issues originally brought to the table.

Most accountants, auditors, lawyers and IT folks I know have no training on dealings with folks with mental health problems in the workplace. I do not know of anyone who can say they would know how to deal with either mentally unstable managers (those whom they report to) or mental instability in those they audit. Our capitalist system proposes that business people function in a balanced manner because the marketplace acts as an invisible counter-weight to bad or irrational decisions and bad behaviors. By some miracle the “marketplace” is self policing, self healing and a good arbitrator of even mental health. The marketplace is supposed to distribute higher profits to those who play by this rule. This neat picture of social and economic behaviors however is flawed. It assumes that all human beings are primarily motivated and controlled by money. Because of this simplistic view, even the smallest of our corporate organizations can be inhabited by well dressed and impressive looking people with serious mental illnesses. Given the epidemic levels of untreated Attention Deficit Disorders, Personality disorders and bipolar disorders in our society, why is it taboo to conclude that these are also at epidemic levels in corporate America? During the hiring process, when most mental disorders can be identified, most organizations do not ask if the candidate has had a history of mental illness, and current law does not obligate the candidate to disclose the information.

So, what do you do when you determine, based on the “pornography” (when you see it you know it) test, that your boss is mentally unstable? The answer given by my Psychologist friend is simple and direct. The answer is to look for another job as soon as possible, especially if you determine that the organization turns a blind eye to the problem. Many mental disorders are not curable, even though, they are treatable if the person obtains long term consistent help, medications and therapy. Given the manner in which our society works, and our corporations are structured, working under a mentally unstable person is a no win situation. Any organization that maintains a person of authority ignoring his/her signs of mental illness is not a healthy organization and may have other serious problems hidden just under the surface. The responsibility of an auditor is to deal with reality in a transparent manner, trying to report risks that may impact stockholder value, assisting management with control’s and solutions for better performance and detecting potential fraudulent acts. When those who manage the audit function, compliance or risk management are mentally unstable, the integrity and reliability of those functions can be in question.

What do you do when you determine, based on the “pornography” (when you see it you know it) test, that someone you are auditing is mentally unstable? The answer depends on whether the mental instability is known in the organization or not. If it’s known, but there is an “unofficial” gag situation, where the personnel department and other managers ignore it, you have a challenge at hand. As an auditor, you have discovered a risk to the organization, you probably also have evidence that the person may be ignoring policies and procedures, is abusive to staff and may have even tampered with audit samples. However, he has held the job for 15 years and each year he gets his bonus and good reviews. His boss of 15 years, a man related to the CFO and a major share holder said the guy is “colorful” but “OK.” To help you make the decision, here are a few queries you should answer:

What is the likelihood that you are the only auditor during the last 15 years to find these irregularities?

Why would the inner circle consider this unstable person “OK” and take the risks associated with his illness?

What do other auditors know about the situation, and what do they say?

What is the company “culture” like, regarding others who ignore and break company policies and procedures?

Is HR aware and concerned about the problems with the manager and his staff.

Are there previous audit reports citing the manager, his department or any compliance issues linked to him?

Are there others in the company with similar conditions?

Has your superior expressed concern over how you may report the findings, without giving you adequate reasons for the concerns?

Are the issues, risks and failures discovered by the auditor been in effect for a long time, in a way that knowledge of them have been an “open secret” requiring that multiple individuals “play along” in order not to make waves?

Has there been an insinuation, a gossip or small talk to the effect that the auditors should not pursue issues with the individual in question because of his “connections” in the company?

These ten questions should give you a sense of where things are regarding the mentally unstable individual, his social connections in the company, the corporate, legal and business culture that nourished him for 15 years, and how you may best proceed. If the answers to these questions lead you to believe that the organization has been aware of the problem, you may be better off working elsewhere. If multi-billion dollar organizations are reluctant to address these issues and resolve them, you need to carefully think about how you can maintain your professionalism and ethics as an auditor, and that may only be achieved by going elsewhere. When the organization is ready to address the issues at hand, or when it is forced to by the legal system, you can read about it in the newspapers. But, an inquisitive person may ask, “in this situation, don’t you have an obligation to report this information to your superiors?” The answer is “Yes.” But, if they already know about it and want you to keep your mouth shut, what can you do? If you stay in the job, you are in essence taking part in a conspiracy and cover-up little different than those that occur during a financial fraud, and if it blows up, you will have as the auditor, to answer some hard questions as to what you knew and when you knew it. Most interestingly, will be how you answer the “why did you not report it” question.

If your queries on the other hand lead you to conclude that you have a new finding, and the mentally unstable person’s condition is unknown to others in audit, HR and/or legal, you should, in consultation with the Chief Audit Officer or audit Director, find a strategy to address the issue and report it according to said strategy. If the company has a policy for addressing mental health issues, you should consult it and incorporate its guidelines in your approach and documentation. This process will likely not be smooth and easy. Imagine if your findings lead to a psychiatric determination that the CFO has bipolar disorder. Can this finding become a “material weakness” from a SOX perspective? It can be argued that the symptoms of bi-polar disorder in the CFO can negatively impact financial reporting! How would you write this up in the 10k and what would constitute an acceptable “remediation?” Can the board call for the removal of the CFO because of this? When do the lawyers step in?

To be fair to all. Not all organizations deal with mental illness problems in a bad manner. Many organizations have invested money, time and have trained their HR and legal departments in ways to address this serious challenge. But, to do so everyone has to admit to the problem and an entire new set of corporate policies and guidelines need to be adopted on how to fairly address mental illness in the workplace. As auditors, you will likely see more and more of these situations as the problem in the general population gains media attention and more people are diagnosed with these disorders. It is also important to note that those who suffer from mental disorders, although sometimes disruptive, conflict prone or unpredictable in the work environment, should not be stigmatized or abused because of their illnesses. The mentally unstable deserve professional treatment for their sake and for the sake of those around them. Without it, they pose risks that will not go away by simply ignoring them.

As always, I will welcome reader comments on the subject, especially if they are based on real life work experiences. Thanks for reading!

Testimonials On Living With Manic Depression (saltedlithium.wordpress.com)
To Tell Or Not To Tell Your Boss: Bipolar and Depression In the Workplace (psychcentral.com)
Mental Health Statistics (psychcentral.com)
Rosalynn Carter pens new book on mental health (seattletimes.nwsource.com)
Screening Employees (Human Resource Executive Online)
Preventing Workplace Violence & Minimizing Employer Exposure(FVLD)
Accommodating Employees with Bipolar Disorder(JAN)
Accommodating Employees with AD/HD (JAN)
The National Workrights Institute
National Institute of Mental Health (NIMH)

Categories: Audit, Compliance, Human Resources, Risk Management Tags: Add new tag, Attention-deficit hyperactivity disorder, bi-polar disorder, CobiT, COSO, IT Audit, Mental disorder, Mental health, Risk Management

Book Review: “The New Data Imperative: Managing Real-Time Risk in Capital Markets” by Dr. Raj Nathan, Irfan Khan, & Sinan Baskan

December 27, 2009 Joel C. Font, Governance, Risk and Compliance Professional 4 comments

: Image by STML via Flickr

It seems that since the arrival of the Great Recession everyone has rushed a book out explaining why it happened and how to prevent it in the future. The feeding frenzy includes folks from all sorts of backgrounds who barely know what Sarbanes-Oxley, a financial statement or a CobiT control is. For many of these “experts,” the reasons for the recession are clearly not financial or regulatory or linked to Globalization, but deeply ingrained in our dysfunctional and narcissistic society and by nasty “capitalism,” which to many is as deadly a tormentor of society as the Black Plague was 700 years ago. The damage caused by the recession is viewed as evidence that there is a need to educate the masses in new righteous ways to make money and legislate new rules over corporate conduct. The new Robin Hoods of course are poised to make lots of money by selling new training programs, conducting seminars in Las Vegas and devising new green and “humane” ways to dismantle capitalism.

Although, writen by Sybase excecutives, The New Data Imperative by Dr. Raj Nathan, Irfan Khan and Sinan Baskan is not one of those new opportunistic books I am so disappointed to see in the book stores today. This book is a breath of fresh air in that it does not overshoot its scope and intent. Although, discussing the recession and using it as a backdrop, the book in its 115 pages manages to convey the what, how, when and why of the information infrastructure behind today’s globalized financial markets, and why changes to these are needed. It does this in language that is understandable to non-technical business people (auditors, compliance, legal and financial management), who for the most part are the ones who need to understand these things, so they can participate in future implementations and improvements to existing systems.

In the next three to five years Risk Management will see an increase in the complexity of analysis, the need for faster data acquisition, faster reporting and the integration of more diverse data sources from in-house and from “the cloud.” Not to mention a likely increase in Regulatory Compliance mandates. For these reasons, the way we approach the infrastructure that supports the Risk Management function(s) needs to be re-conceptualized. “The New Data Imperative” provides a quick snapshot of how to achieve this. The book looks at the state of current Risk Management “silos,” their data feeds, analysis cycles, reporting structures and overall data infrastructure, explaining why these current systems fell short during the recent financial crisis and provides us with a well conceptualized picture of how to transition, often without major and costly changes, into the data environments needed for the new Risk Management processes now being proposed by regulators, the Big Four and some of the leading international financial standards organizations.

In addition to its clarity, in my opinion the book serves another important purpose. That of attempting to educate “legacy” type IT managers who in many organizations today have “stale” skill sets and are often ignorant of industry best practices and trends. As many an experienced IT auditor can confirm, these managers are ill prepared for the future and can not visualize the infrastructure changes needed to implement and maintain the Enterprise Risk Management systems of the post Great Recession era. Because these folks can not visualize the future, they tend to be serious obstacles to improving performance and strategically positioning IT investments for competitive advantage. Although, high in authority because of seniority or organizational politics, these folks have managed to carve out positions where they appear to provide value not by what they do, but by how they stop others from doing. They are in a way the “Gate Keepers” against innovation and process improvements. If by some miracle some of these individuals were to read “The New Data Imperative,” I think great technological achievements would take place in their organizations.

If you are an IT Auditor or a Risk Manager for a financial institution, I highly recommend that you familiarize yourself with this book. I believe the book will bring you up to date on the latest real time risk management concepts and will open your eyes to some of the technological challenges we will be facing in the next three to five years as Enterprise Risk Management evolves to a more mature level.

Because the book is small and unassuming, I also recommend it as a gift for those “legacy” type IT managers I mentioned earlier. It may be the most eye opening technology book they’ve read in the last 10 years!

You can purchase “The New Data Imperative” from: Today’s Audit Journal bookstore.

If you’re wondering about the “Nude Sunbathing” sign above…. let me explain why it’s here. This picture was taken last July one block away from the Jacob Javitz Convention Center in NYC, on the day the National Enterprise Risk Management Club of Buenos Aires, Argentina, was holding its national awards for the most creative use of Twitter in a crisis situation. When members saw this sign they Twitted all the participants, and half the Jacob Javitz Center emptied as the men rushed to the Hudson River to watch the annoyed sun bathers. Now the question being debated by serious Harvard sociologists is: Did Twitter empty out the Jacob Javitz Center, or was it the naked sunbathers and their uncontrollable effects on the hot Latins from Argentina?

Risk Management Lessons from the Global Banking Crisis (blogs.law.harvard.edu)
New Survey Reveals Increased Focus on Risk Management in Wake of Financial Crisis (prweb.com)

Categories: Book Review, Humor, Risk Management Tags: Book Review, Capital Markets, CobiT, Data Analysis, Enterprise Risk Management, Real Time Risk, Risk Management

Response from Senator Bob Menendez to the “Dumb Auditor” Article

December 16, 2009 Joel C. Font, Governance, Risk and Compliance Professional 3 comments

Senator Bob Menendez

Dear Mr. Font:

Thank you for contacting me to express your opinion on banking reform. Your opinion is very important to me, and I appreciate the opportunity to respond to you on this crucial issue.

I appreciate you taking the time to provide your ideas on how we can make changes to the banking industry to improve its efficiency and transparency. Every day New Jerseyans are working very hard to provide for their families, but current market conditions have made it difficult for families to save or access credit. The financial collapse last year demonstrated the need for increased transparency to protect investors and consumers from fraud and irresponsibility. Americans simply cannot afford the risks associated with widespread economic instability such as losses of jobs, savings, and benefits. I am committed to ensuring that our financial markets are fully regulated and operate in the best interest of the American people.

As a member of the Senate Banking Committee, I have long stood for financial reforms that promote smart, healthy, and sustainable development. I rely on the important communications I receive from my constituents to guide my work in the United States Senate. On this, as with any issue, there are many different view points, but please rest assured that I will continue to work diligently to respond to the many valuable insights I receive from New Jerseyans like you.

Finding solutions to the issues you raise is what drives me to keep standing up for New Jersey families. Again, thank you for sharing your thoughts with me. Please do not hesitate to contact me if I may be of more assistance.

I invite you to visit my website http://menendez.senate.gov to learn of other important issues in New Jersey.

Categories: Audit, Compliance, Corporate Governance, Legal Issues, Market and Industry News, Politics Tags: Auditing, Corporate Governance, Political, Regulatory Compliance

Response to Comments from the “Dumb Auditor” Article

December 6, 2009 Joel C. Font, Governance, Risk and Compliance Professional 1 comment

: Image by Sebastian Niedlich (Grabthar) via Flickr

To all the readers who left comments regarding the “Dumb Auditor” article. Thank you for visiting the blog and taking time to share your excellent ideas with the group. The “Dumb Auditor” article has been read by thousands of interested people from around the world, indicating that the issues discussed are of serious importance to our profession. Most of your comments clearly show “battle scars” resulting from real life work situations, making them more valuable than I ever expected.

It is also clear from your comments that auditors would like some resolution to these problems. Or, at least some structural changes in the industry that lead to diminishing auditor exposures, while they do their jobs protecting shareholder interests. Although, many in the business world share similar situations, risks and moral dilemmas, it is the auditor who is expected to uncover fraud and other illegalities with few or no legal and financial protections for themselves. And, few are similarly bound to maintain confidentiality about their work and the very things that often get them fired. It is not unusual to hear Internal Auditors tell of stories where they “uncovered to much” and got fired for it, but can’t talk about it! What does this tell us from a legal, societal and ethical perspective, and where does it put the professional organizations that are supposed to provide guidance and protections for the profession?

From the more than 30 comments left in the blog by readers to date, I am particularly impressed and grateful for the following:

1) From Felix, on November 30th.

Excellent proposals with excellent potential. Felix discusses four items that should be considered at the highest levels. Item # 4 on his list is something I had thought about in the past (and, I suspect other auditors have as well), dealing with Professional Liability Insurance “provided by the PCAOB (or other body holding CFO’s/auditors to ethical/moral standards) for auditors and CFO’s. If a CFO or auditor is fired due to claimed unethical reasons, they are eligible to receive 100% of what they were making.”

There are countless types of liability insurance for professionals, such as errors and omissions for attorneys and accountants and medical malpractice. Why not develop one that insures against wrongful dismissal of auditors, specially when the dismissal involves a dispute with management due to the normal performance of the auditor’s duties, ethical or fraud related matters?

2) From Mark Pennington, on November 30th.

I was impressed with the brevity, the directness and the underlying picturesque quality of Mark’s comments.

Disregarding his tone…. I think he is correct in that there is a very large segment in management that does not care. Why should they? They do not perceive to be negatively affected, and their personal bank accounts keep increasing instead of decreasing with the status-quo.

3) From Rodney Kocot, on December 2nd.

I think Rodney’s comment is the most eloquent posted in terms of describing a situation where auditors get fired for trying to do the right thing. I think that everyone who has been an auditor for several years recognizes this type of story, either from first hand experience or because it has happened to a peer. Unfortunately, because of confidentiality agreements and fears of being black listed, these stories rarely get out to the public or beyond auditor circles.

4) From Adis Vila, on December 5th.

I appreciate the visit from Adis, a person that has done a great deal of work in the corporate governance and ethics areas, as well as in government.

The need for “Ethics Training” is clear and I am glad someone with a strong background in this area brought it up. However, my sense is that ethics training yields future results and it’s something that impacts entrants to the business world, with limited impact on the “old dogs” running lose right now in positions of authority. Training someone like a Bernie Madoff in “Values” and “Ethics” would be an interesting effort probably yielding few good results. We auditors are in the trenches dealing with societal and organizational challenges as they are now, not as they should be. Most auditors I know view compliance training as something that goes hand in hand with ethics.

I agree with Adis that we should concentrate more on a “Values-Based” ethical culture, because I believe that as a society we dropped the ball on this one a long time ago. I will refer to a few comments posted by Felix on November 30th which reflect my views on this issue:

“What is for sure is also that some crooks would not be crooks if society would not accept as “good” many things that are NOT good. The unfortunate relativism that we live in now a days is contrary to how the United States was founded. It was founded on deep moral principles and as a result there was a key ingredient that was not there in many other countries or societies throughout history: trust. Trust can only exist when the society is a morally correct society that has not transformed values. In other words when a bad act is considered OK by many and vice versa. The problem we are facing in the United States of today runs deeper than audits and rules.

The problem goes to the core of the humanity of our country.”

5) From Ben, on December 8th.

Ben’s comments are well thought out and clearly come from experience. His suggestion that auditors take a more careful and inquisitive approach during their job interviews in order to improve their chances of accepting jobs in organizations that more closely reflect their ethical values, is excellent.

I also agree with Ben regarding the approach with mid-level management and the need to invest time educating folks in Risk Management. His humorous call for prayers, relaxation and meditation techniques during audits of sales functions is also unique and worth considering!

Prior to the popularity of “Social Media,” blogs, Twitter and the web, most controversial issues impacting an industry or profession remained in a semi-secret state. Today, they can be known to thousands of people instantly. The power of knowledge or as they used to call it, “The Pen” is stronger than the “Sword,” and in most cases it is also stronger than the “Dollar.” Because of this, I believe that the “Dumb” auditor article will make a positive contribution to the efforts being made to resolve the issues cited in the article. At minimum, there will be more awareness of the problems from the perspective of the auditor.

Thank you again for visiting, reading and leaving your comments.

What Boards Should Be Doing Right Now (blogs.law.harvard.edu)
Moral and Ethical Ambiguity, Part 2 of 4 – Morality (moebiusadventures.com)

Categories: Audit, Corporate Governance, Legal Issues, Market and Industry News, Politics Tags: Auditing, Corporate Governance, Ethics, Insurance, Legal, Liability insurance

Auditing Career: Do “Dumb Auditors” have more Professional Longevity than “Smart” ones?

November 29, 2009 Joel C. Font, Governance, Risk and Compliance Professional 53 comments

: Image via Wikipedia

Two days ago I attended a nice Thanksgiving party given by a CIO friend, who like in previous years, had invited several CFO‘s, corporate attorney’s and high level management people from high profile Fortune 500 companies in the New York region to his house. After a few drinks and delicious turkey, conversations about the state of the economy, technology and the headaches of regulatory compliance ensued. There where two auditors in the group and it felt as if we where the only ones who did not feel regulatory compliance is a headache. My Merlot and turkey friends, perceiving that they had numerical superiority over us, went on to a typical “we hate the auditors” discussion, where we had the “pleasure” of hearing every criticism launched against auditors since the time of Heraclitus. Thank goodness I too had access to the Merlot. One of the discussions that has stayed in my mind is one about how “well appreciated” dumb auditors are. And, this I’ve decided to share with you.

Most auditors learn early in their careers that auditing is not a popularity contest. As a result they adjust to the fact that they are paid to investigate, search, test, snoop around, and in many cases confirm the existence of wrong doing and mistakes by members of the organization at all levels. The auditor is usually the person who has ulterior motives for asking questions, and the one who usually does not bring good news. The auditor by his/her simple presence disrupts the “normal order” of things, makes the staff feel uncomfortable and require that all evidence be double checked for accuracy and legitimacy. Often, when those being audited most want the auditors to “go away,” some action or words deep in the crevices of the organization send a message to the auditors to dig deeper or further expand their questions. In common language, auditors are a pain in the neck.

The intensity of hatred or dislike towards the auditor however varies depending on his/her ability to understand what he/she is testing or investigating. The smart, experienced auditor tends to ask deep, relevant and timely questions, often not found in a strict audit script or checklist, which can open the doors to problems and issues hidden just below the surface. The smart auditor is happy when he/she finds problems, because he/she sees himself as a solution or insurance policy against risk exposures to the company. However, this feeling is not shared by those who “own” the problems and depending on company politics, the reactions can range from lukewarm admission, challenges bordering threats from some levels of management, to a long term stealth campaign against the auditor leading to his/her dismissal for supposedly “unrelated reasons.” Like a Whistle-blower, the good auditor walks a dangerous road. During difficult times, the good auditor has few or no allies.

The dumb auditor on the other hand, usually sticks to a rigid script or checklist, and is not likely to expand his questions beyond the “scope” of the audit, preassigned or created with the approval of management. The audit process of the dumb auditor tends to be quick, rarely discovering problems and always neatly on time. His reports usually sound like this: “We tested A, B, and C and found no exceptions. Managements’ controls are working according to established policies and guidelines and” (here is the mandatory recommendation for improvement – so it looks like some work was done), “we believe the Segregation of Duties process in AP can be tightened by implementing the following….. Otherwise all is well.” This cookie cutter report, used by both Internal and External auditors, is the type that makes its way to most audit committees today. This is also the type of report, according to my friends at the Thanksgiving party, that management wants and pays handsomely for. I found myself looking at the other auditor and realized that we where both nodding in agreement. My friends in the party, all experienced dealing with auditors, pointed out that “Smart” auditors, or auditors with independent minds can not last long in a typical organization, because the very act of following their ethical, inquisitive and legalistic mentalities gets them into serious conflicts with management and they end up fired after short tenures. Also, good auditors have few champions in the organization who see value or gain in “protecting” someone who is serious in his/her responsibility to investigate or test anyone (including them) in the future if they have to. This is simple human nature. A “Dumb” auditor on the other hand, creates few waves, does not offend or criticize too much, uses neutral and complimentary language in reports, and keeps to his/her “scripts” as planned by management. By playing dumb, this type of auditor is indirectly “winning friends and influencing people.” His/her back is covered because he/she is needed by those who need coverage. The dumb auditor has allies.

In light of current scandals, like the Bernie Madoff case, and the mortgage meltdown, it has become common for many to ask: “And, where were the auditors while all this was happening?” My answer has to be that most of the auditors involved where diligently doing their jobs as good “dumb” auditors do, so they can stay employed. That is, they where auditing every nick and cranny that was within scope and within the “Risk Appetites’ of their organizations, as set by “management.” But, what about the codes of conduct, the audit charters, the PCAOB, the SEC, the GAAS‘s, ISACA and the IIA‘s. Don’t these organizations have some level of control over how auditors should conduct themselves and how they should investigate and follow up on questionable activities? Are all of these structures useless? My answer is no. These are not useless organizations, and without them, the problems cited by my friends in the Thanksgiving party would be much worse. The codes of ethics, guidance documents, audit frameworks and standards created by these organizations are the only line of defense we auditors and audit committees have against the many Barbarians who dwell in the halls of corporate America today. But, are these standards and frameworks sufficient? My feeling is that they are not, and here is why. Money corrupts as every auditor knows. When you follow the money you find the power. Organizationally, there is an imbalance between the auditor and those he/she audits. On the one hand you have a well meaning, ethical person who wants to do the right thing, making an average mid-level management salary, tasked with uncovering wrong doing among those at levels that can crush him/her with ease, and whose interests are the maintenance of the status-quo, a low profile and making sure the company’s stock value is not disrupted by doubtful auditor reports. In most companies, those in the Director, V.P. and “C” levels (usually persons with net worth’s in the millions of dollars and stock holders in the company) can easily muster the resources of the organization whenever they raise a red flag regarding a “trouble maker.” The controlling factor here is not bribery, but the threat of dismissal. So, in my opinion things boil down to a primal level for the auditor. Ethics, integrity, morality, legality and professionalism on one side, versus no job on the other. Unemployment, inability to pay the mortgage, damaged credit rating, children without college tuition’s, etc. How many good auditors can consistently afford to be martyrs, and when it happens, who shows up at their door to help them pay the mortgage? The fact that the majority of auditors are good, ethical, law abiding and take their oath’s of conduct and ethics seriously is a reflection of the social, religious and cultural values they share with the greater society, and less so on other types of controls promoted by various groups. As these cultural, religious and social values erode, resulting from poor education, dysfunctional families, media aggrandizement of thieves, the belief that the “bad guys” win and little understanding of civics, I suspect we will see more problems relating to poor auditor ethics and values. In general, auditors are still good because they perceive that the society provides more positive reinforcements for good behaviors than bad ones.

In addition to the money and power challenges I noted above, there are issues dealing with the “Culture of Auditing,” which most of us are familiar with. In my opinion, many of these favor the “Dumb Auditor.” Some of these also help explain why many Madoff type schemes go “Undetected.” Here are the top fifteen that come to mind. I am sure there are others:

Auditors are taught to find ways to give bad news in a positive manner. Avoid bad news as much as possible.
Auditors should avoid using the words “Failure,” “Problems,” or naming specific individuals who fail or pose problems. Instead they should call these things “Exceptions,” or “Positive findings Needing Improvement.”
Even when management has repeatedly ignored auditor recommendations and warnings, auditors are expected to be “flexible” and at best point out the issues as “still needing some levels of improvement.”
Auditors are bound by extreme discretion and confidentiality. They are to be like flies on the walls. Rarely seen and not too vocal on any subject or occasion.
Management has the last say in terms of what is possible by way of solutions to issues raised by audit. The “Business” is the key determinant in whether a risk gets addressed as recommended by audit.
Auditors work on behalf of management, and are not to be seen as impediments or obstacles to managements’ decision making. Aggressive auditors can inhibit management’s entrepreneurial spirit.
The auditor is there to protect the business from outside risks.
Management sets the “Risk Appetite” for the company. Auditors work within those parameters. Even when the parameters are not well defined (on purpose).
Auditors are supposed to uphold the utmost ethical standards, but often their superiors lie, cheat and have no scruples. Some times the code of Ethics, zero tolerance statements, and even the Audit Charter are disregarded at higher levels, while zealously enforced at the lower levels.
Auditors are supposed to remain positive and un-moved, even when those audited usually assassinate their character, create rumors and gossip about their professionalism, plant fake or doctored evidence against them, and call for their dismissal.
Auditors are supposed to maintain meticulous notes and documentation, while many of their superiors rarely answer email requests for clarifications, or document an opinion.
Auditors are supposed to advocate for and practice “meritocracy” being on a constant race to obtain and maintain professional certifications. While it is not unusual to see many of their superiors having reached positions of authority because they have either slept, drank, bought or strong armed their way up the ladder.
When the Chief Audit Officer is weak, unstable and/or indecisive, audit work is reactive and there is unusual turn over in Internal Audit. Expertise, maturity and professionalism has little time to take root. “Dumb Auditors” flourish in these environments.
In a recession and during cost cutting, some Audit departments let go of their “expensive” talent, keeping lower paid less experienced staff on hand until better times (and budgets) return. “Dumb Auditors” flourish in these environments also.
When the “C” level executives have been around for 10, 15 or 20 years and their “old boy” culture does not care about “irritants” such as “compliance,” or “industry best practices,” or “well designed controls,” and the head of compliance and legal counsel are never in the mood to “disturb” the old boys, smart auditors often become dumb by way of necessity.

As I prepared to finish this article, I discussed it with my friend, the other auditor at the Thanksgiving party, and he felt many of the issues tackled here are highly controversial and uncomfortable. He said I make many generalizations like what constitutes “Dumb” or “Smart.” He said that what I call here the “Dumb Auditor” may really be the “Smart” one. Every person faced with the sorts of challenges I mention has a huge reservoir of personal, professional and family reasons for taking one or another path, and those are known only to that person. Passing judgment as I appear to do in this article may be too insensitive and simplistic. The issues are just too complicated to put them in simple moral boxes.

I admit that my friend makes good points here, and I can only say that in this article my intent is to shed light on what is clearly a serious challenge with ramifications that go far above those of individuals. This is a serious systematic problem in the business world and many good minds in government and in professional organizations worldwide are working hard to find the right solutions. In an ideal world, the typical auditor should not have to spend sleepless nights wondering whether he/she should play “Dumb” or “Smart.”

I personally do not have a clear answer on how to solve these dilemmas for others. I only know what my ethical, moral and social values are and I have first hand experience on the high costs and frustrations of being a “Smart” auditor.

If you are a new auditor, I hope I’ve alerted you to issues that may come your way sooner or later. If you are an experienced auditor, I hope that by reading this you realize that you are not the only one who has seen these things.

To all readers. I will appreciate it very much if you left your comments on this subject, so we can make this a more diverse exchange. Do you believe that “Dumb Auditors” indeed have a longer professional longevity than “Smart” ones?

Falling Friehling: Madoff’s Auditor to Plead Guilty (blogs.wsj.com)
We’re Paying The Legal Fees For Those Who Defrauded Fannie Mae and Freddie Mac (crooksandliars.com)
The Jones Day Lawyers Looking to Take Down SOX (blogs.wsj.com)

Categories: Audit, Compliance, Corporate Governance, Jobs, Training and Certifications Tags: Auditing, Cheating on Audits, Corporate Governance, Fraud Investigations, Generally Accepted Auditing Standards, Public Company Accounting Oversight Board, Regulatory Compliance

New from DRII – Certified Business Continuity Auditor (CBCA) or Certified Business Continuity Lead Auditor (CBCLA)

November 18, 2009 Joel C. Font, Governance, Risk and Compliance Professional 4 comments

Atlantic City, New Jersey

New Audit track for Business Continuity Professionals and IT Auditors. If you are an experienced Auditor or Business Continuity Planner, this is your opportunity to get certified as a Business Continuity Auditor by the leading BCP organization in the USA. DRI International will be offering training in Atlantic City, New Jersey this coming April. For more information on this course, see the notice from DRII below:

Two opportunities for the training you want!

The National Fire Protection Association (NFPA) and the Disaster Recovery Institute International (DRI) have joined forces to create an education and certification program that will qualify participants to audit disaster/emergency management and business continuity programs against existing standards and regulations. Certifications available are: Certified Business Continuity Auditor (CBCA) or Certified Business Continuity Lead Auditor (CBCLA).

Through this program, participants will be able to apply the key components of disaster/emergency management and business continuity, the relevant standards, laws and regulations, the process of risk assessment, vulnerability analysis, loss prevention, risk mitigation, and develop, implement, test and maintain their plans and procedures.

The course will cover existing legal and regulatory requirements by industry and country, as well as emerging requirements, including BS25999, SS540, US PL 110-53 (PS-Prep), NFPA 1600, ASIS, DRI International’s professional practices, financial services, insurance, healthcare, utilities, public sector guidance and a host of others will be explored. It will also cover the processes by which disaster/emergency management and business continuity programs are initiated with an eye toward corporate governance, policy, and procedures. More in depth emergency and disaster management will be provided by NFPA.

At the end of the course, a unique. audit track, qualifying examination is conducted and individuals who have passed will be eligible to apply for certification as a Certified Business Continuity Auditor (CBCA) or Certified Business Continuity Lead Auditor (CBCLA). The certification level (CBCA or CBCLA) will be granted based upon the amount of demonstrated audit experience of the applicant. Those seeking the CBCLA designation will be required to provide references to verify that they have at least five years of active audit experience.

For course and education related questions please call the DRII Education Department on: Toll free numbers: 866-542-3744 and 866-535-3744

This course is designed for novice & experienced corporate planners, internal & external auditors…

Course Name: BCLE-AUD

Start Date : 04/26/2010

End Date : 04/30/2010

Course Cost: $2900.00

Instructor: Not Specified

Location:

Atlantic City Convention Center

1 Miss America Way

Atlantic City, NJ 08401

DRII The Institute For Continuity Management.

This was not a paid promotional announcement.

DHS Announces Intent to Adopt BSI’s Preparedness Standard (newswire.ca)
Business Continuity Management Lifecycle and Key Contractual Requirements (punetech.com)

Categories: Audit, Business Continuity, Jobs, Training and Certifications, Risk Management Tags: Auditing, Business Continuity, Business continuity planning, Emergency management, National Fire Protection Association, Training and Certifications

Enterprise Security: Cheating on Your IT Security Audits

October 29, 2009 Joel C. Font, Governance, Risk and Compliance Professional 4 comments

: Image by Computer Science Geek via Flickr

I recently read a good article regarding IT Security Audits which I thought many readers would be interested in. Cheating on IT Audits by IT staffs is not unheard of to most of us in the auditing business. However, it is a taboo subject that rarely gets any media attention and few ever discuss in public. When ever we Auditors perform an audit, all the information provided to us is accurate, never doctored, performed within the time frame or scope of the audit and properly authorized by management (if you believe this you may be on drugs). Cheating on audits, on purpose or out of ignorance is common, and this is one of the reasons we have to verify the authenticity and relevancy of the samples and evidence provided to us before we can accept them.

The article points out that 20% of the 151 IT Security professionals recently polled at a major InfoSecurity conference admitted to cheating on IT Security Audits of firewalls. Although, this sounds like a high figure and I have never investigated this in any formal way, I will venture to say that in the “field” the number is probably higher than 20%. Here is an excerpt from the eWeek Security Watch article, which you can read in its entirety by clicking the link at the bottom of the post:

“An audit isn’t worth much if the people doing it are cutting corners. Unfortunately, a survey by the folks at Tufin Technologies suggests many IT pros may be doing exactly that.

The survey, which was conducted at the InfoSecurity Europe 2009 Conference in April, took opinions from 151 IT security pros. The aim was to determine companies’ approach to firewall auditing and management.

What Tufin turned up was that 20 percent of the respondents admitted they or a colleague had cheated on an audit to get it passed. The company did not ask specifically how they cheated, citing time constraints. But if applied generally, it could be there are many networks operating a false sense of their own security posture.

Going deeper, 9 percent of the respondents admitted that they never bother to check and audit their firewalls at all….”

To continue reading this interesting story, please click the link below:

Enterprise security strategy – Cheating on Your Security Audits – eWeek Security Watch.

What do you think. Am I stretching it here by thinking that the real figure may be higher than 20% ? Leave a comment (anonymously if you like).

Cyber Attack Fear As Firms Cut IT Costs (news.sky.com)
More security breaches hit midsized companies (news.cnet.com)

Categories: Audit, Compliance, Risk Management, Security Tags: Cheating on Audits, Firewall, IT Audit, Risk Management, Security

Auditing Career: Traveling to Dangerous Places

October 21, 2009 Joel C. Font, Governance, Risk and Compliance Professional 10 comments

: Image via Wikipedia

So, you’re now sitting pretty working for a big Fortune 500 company with the enviable task of auditing subsidiary divisions in three continents, and you’re only 27 years old. If your friends back in Mumbai could only see you now!

This is not an unusual situation in many internal audit departments in large organizations where fresh young auditors are recruited with the understanding that they are to travel 50 to 75% of the time to places few of them knew existed on the map. The natural inquisitiveness of youth, the romantic appeal of traveling the world, the pay, the superman complex, the arrogance and the lack of common sense we all have at that age makes us perfect to accept challenges others with more experience would probably turn down. And, this sometimes occurs when young auditors and consultants accept without much thought, assignments in dangerous places.

In America, knowledge about geography, international politics, cultural, ethnic, religious and criminal activities in the rest of the world is weak. There are many well educated Americans who believe that the power of the US Constitution somehow extends beyond our borders, or in some unknown fashion is respected by most foreign countries. There is also a belief that the US version of “the rule of law” is accepted everywhere else in the world. And, that in a worse case scenario, if one is in trouble overseas, a lawyer just like in the USA will save the day. This is a dangerous misconception.

On December 10, 2008, my cousin Felix Batista, one of the world’s most respected and experienced international security consultants was kidnapped in Mexico while giving a conference on anti-kidnapping strategies. To this day, Felix’s whereabouts are unknown and many presume him dead. The plight of his wife and children and our family to bring closure to this ordeal can be understood by visiting the Felix Batista media blog, setup to track coverage of his disappearance. I shared an interest in Crisis Management with Felix, except I chose the technology route and he the international security one. I will share with you a few items you should keep in mind when considering a foreign assignment to places you are not familiar with, or if you are a new employee still unfamiliar with your organization. I hope you do not consider these too radical or old fashioned, especially if you’re relatively new in the field:

1. Understand that your company’s image overseas is likely to be different than what it is in the USA. You need to research this from various sources and understand that you may be putting yourself at high risk by simply identifying yourself as an employee visiting from the USA.

2. Understand that the behaviors, expectations, values and views of a person who earns a yearly income of less than 20 or 25% of what you make, will be very different than yours. Be aware that your US based ethics, morals and values come back on the plane with you, and they do not feed that persons’ hungry children who are left behind.

3. Understand that in many countries the “law” and the criminals are the same guys. And, that includes the lawyers. You need to research this and determine before hand what to do in case you are the victim of a setup or involved in an accident. Ending up in a foreign jail is not nice!

4. Understand that in many countries and cultures physical violence is the first step taken in addressing a dispute or misunderstanding. If you’re lucky, you’ll get a chance to talk later.

5. Understand that your actions, innocent in the USA, may jeopardize the lives of locals. Meeting someone in a restaurant for example, may brand them as a spy for the company or worse off, an informer for the CIA.

6. Understand the capabilities and limitations of your company’s security department. Do not assume that the V.P. or Director of Security, sitting at corporate knows much about the foreign risks you may face. A good number do not. Ask around to see if anyone has ever met a V.P. or Director of Security who has admitted to not knowing about important risks to low level employees?

7. Understand that in the USA you may be a miserable Junior Auditor, but in many places your earnings put you at the top of the food chain, and you may be feared the same as if you where a member of the Board of Directors.

8. Understand that its OK to dress like a cool dude, a Southampton beach bum, a ghetto boy or a spoiled Princess in your spare time, in the USA. Doing so in many places around the world is an invitation to be robbed, sexually molested and even beaten.

With these things in mind, you should also ask the Audit Director or your Manager the questions below. If you are uncomfortable with anything, say so because in the end you will be the one responsible for your life, not someone in an air conditioned office 3,000 miles away:

Are there any World Health Organization (WHO) travel restrictions or vaccine requirements in effect for the country in question. If so, is the company getting you vaccinated?

Is the country or region on any CIA or State Department warning list for US citizens?

If your company has been doing business in the country in question for some time, does it have a bi-lingual and/or bi-cultural staff in place to assist you. If not, why not?

Has your project lead managed previous projects in the country in question and if not, why was he/she selected to lead this project. Is he/she qualified, someone’s favorite pet or simply the only one available?

Is there an official report or area analysis assessing the region’s geography, politics, cultural, ethnic, religious and criminal activities so company personnel can obtain a quick education and know what to expect when they arrive?

Have you been, or will you be briefed on how to handle instances of political unrest, terrorism and natural disasters at the places you are expected to work?

Is there a properly documented and authorized company policy for foreign travel and work?

What is the official company policy in the event an employee is kidnapped and held for ransom, in light of Foreign Corrupt Practices Act (FCPA) restrictions?

Does the company carry Kidnap, Ramsom and Extortion Insurance covering your work?

Is there a Crisis Management Plan in place that can be executed, in the event there is a problem with an employee working overseas. And, if there is one, who is on the crisis management team and when was the plan last tested or exercised?

If you are killed while working overseas, what is the process in place to handle the legal, transportation, funeral, family and financial issues that will have to be dealt with. Who will pay for your funeral?

If you are held hostage for a significant period of time, what is the company’s policy regarding your compensation. Will they make payments to a family member and for how long?

If your company holds an insurance policy on you, (Special Risks) which pays them as beneficiaries in case you die or are injured while working, does it cover your work overseas? If so, find out the history of this practice and details of any deaths and payouts. Does the practice indicate anything of concern?

Do you have a Will in place that deals with the possibility of dying overseas. Do you have a Living Will that deals with the possibility of being in a critical condition at a foreign hospital?

Do you have a medical and dental “dossier” on record with the company (respecting all HIPPA regulations), or with a close family member, which can be easily referenced by foreign and domestic medical personnel in the event you are hospitalized or your body needs to be identified?

If you need medical attention while at the foreign location, has the company provided you with information on obtaining it from local doctors, hospitals or clinics?

Have you been given information about the US Embassy and Consulates in the country where you will be working, and who and how to contact in case of an emergency?

Will the company let you opt out of a particular trip if you are uncomfortable with the safety conditions at the destination and the type of security provided by the company. If not, what is the rationale and what are the guarantees provided to ease your concerns?

If you work for a company that has these things in place, and is experienced in sending people to work overseas, you’re in good shape. But, regardless of your company’s maturity level on this issue, it is your responsibility to make sure you do not put yourself in undue danger. Assume nothing and do not be shy about asking questions.

Many places around the world do not require excessive planning or precautions for “the worst case scenario,” but you need to be aware of the good places as well as the bad ones. Experienced international workers do not assume that all foreign engagements will be without challenges, surprises or risks. And, they do not wait until they are in danger to wonder how their companies will react, or if they can react at all.

Going through this type of exercise may seem unpleasant and uncalled for, especially if you hold the belief that most people are good, that all Americans are loved around the world, that there is no threat of terrorism, that the violence attributed to drug cartels is over rated, and that the disparity between rich and poor is a myth. If you hold these beliefs, I wish you the best and hope you are able to hold them for as long as possible, without reaching any life threatening situations.

For the young auditors and young consultants out there, excited about the travel and the life of an “expense account junkie,” I say go for it. Work hard and play hard, but do it with your eyes open and as safely as possible. And, always give yourself the option of not going if you sense the risks are too high or those tasked with protecting you are clueless, incompetent or irresponsible.

What do you think? Leave us some “Comments” regarding your views on this matter and perhaps some personal experiences as well.

Categories: Audit, Human Resources, Jobs, Training and Certifications, Security Tags: Dangerous Destinations, FCPA, Felix Batista, Human Resources, Jobs, Mexico, Rule of law, Security

A Painful Lack of Security Jobs

October 17, 2009 Joel C. Font, Governance, Risk and Compliance Professional 5 comments

: Image by worldsurfer via Flickr

I just read this excellent article from SCO Security and Risks magazine online, regarding the state of the job market for top level IT Security professionals, and I decided to share it with you because my sense is that we have been experiencing a similar situation in the IT Audit field.

The economic downturn has forced many companies to cut corners, and get rid of many folks at senior management levels (including many CISO’s and IT Audit Directors), creating serious hardships for a layer of individuals who are by all standards, the most qualified, best certified and experienced in the industry. These individuals are not finding work because they are poorly qualified, but because companies no longer want to, or can not, pay them for having reached these high levels of expertise and professionalism. The typical company in today’s environment is looking to hire a lower level (lower paid) “Analyst” with mid-level technical skills over a well seasoned IT Security professional. From my discussions with peers in IT Audit, the same is happening with folks holding multiple certifications, CISA-CFE- CISSP or CISA- CBCP-ARP, which would have been insane or close to impossible just two years ago. This sort of thing is happening all over the country as the article points out, and will have long term negative impacts on both companies and the individuals experiencing these hardships. Below is an excerpt from the SCO Security and Risks magazine article, which you can read in its entirety by clicking the link at the bottom of the post:

“An IT security pro’s personal tale of a long and bloody job hunt and what it says about the industry’s current state of affairs.

We can blame it all on this dastardly economy, but even in good periods, qualified individuals find it difficult to land a job as an executive.

Just recently, I applied for a job as a director of information security. The position reported directly to the company’s hiring manager (CIO). It was widely advertised at the company so many of my friends and colleagues knew who the hiring manager was. I had already contacted the CIO directly — and had subsequently been introduced to him and recommended by other CIOs who knew him well, so the hiring manager immediately e-mailed me to say to contact the HR director for an initial phone interview and to call him later that same day.

Both interviews went extremely well, with conversations lasting well over an hour. We covered their challenges that I could address and gravitated to small talk on our past experiences. We clicked and had long, enjoyable conversations. The CIO said he would bring me in for a face-to-face meeting the following week once he had a chance to interview other candidates.

Deep down I was overly cautious, having been burned in the past, as I explained to another candidate who had applied. I said, “It would appear to you I’m a natural shoe-in or on the CIO’s short list by knowing so many people and from the work I do. But it is getting to the point that it no longer matters who and what you know, not even if you’re a close friend of the hiring manager.”

Being well-known in the industry and the local IT community, I knew who these other candidates were, and we shared much information. It is a small world.

In the weeks that passed, I sent the CIO two follow-up e-mails, I also e-mailed the HR director in California. All three were met with silence. I also left the CIO two voice mail messages — one on his office line, the other on his personal cell phone — and neither was returned. After three weeks, I received a phone call from the HR director telling me the CIO was unsure about the position. He was contemplating diminishing the role to a lesser grade and I was, of course, overqualified, and so were the other candidates…..”

To continue reading this interesting story, please click the link below:

SCO Security and Risks Magazine

What do you think? Are you a high level person experiencing something similar in today’s economy. Please share by leaving a “Comment.”

Categories: Audit, Human Resources, Jobs, Training and Certifications, Security Tags: IT Audit, Jobs, Security

Auditing Career: How to Focus on High Value Skills

October 14, 2009 Joel C. Font, Governance, Risk and Compliance Professional 7 comments

: Image by Remko van Dokkum via Flickr

Recently, I received an email from a young auditor, asking that I advice him on how to focus his resources in a way that will yield the most valuable skills for the future. Especially in a future where IT Audit and Financial Audit are meshing. Below is the email, with his name changed to protect his privacy:

“Hello Joel,

I have a question for you. I have a business background having done Chartered Accountancy and then also did CISA. I also worked in the Enterprise Risk Services in Deloitte. The field of IT Audit requires an understanding of the business processes as well as the technical knowledge of ERP, OS and other applications. Since one cannot be an expert in both (business & technical), how can one achieve a balance between the two and know which skills will be most valuable in the future.

Regards,

Mr. H. Dalad Wasi”

This is, in my opinion one of the most important questions auditors should be asking themselves today. Gone are the days when auditors could rely on a static set of skills and practices to succeed in their careers. And, gone are the days when most auditors, internal and external, had the good fortune of having job security to the point where they could, over a period of many years, fine tune company specific “routines” that allowed them to remain in their company’s insular (and sometimes provincial) cultures, where bad habits and bad practices went unnoticed and unchecked for decades. As a result of Globalization and market realities, survival for most auditors now depends on their abilities to re-educate themselves quickly and in gaining a strong foundation in the internationally accepted frameworks promoted by organizations like IIA, ISACA, ISO, IRCA and the AICPA. After gaining the basic certifications issued by these organizations, my focus would be as follows:

1) Prepare to change the focus of your career several times over the next 5 or 10 years, in order to adjust to rapid changes in the economy and as technology forces change the society in general. What I’m saying here is that 10 years ago there was no Sarbanes-Oxley and IT Auditors where still focused on AS-400’s, EDI networks and the Internet was still not well defined as a viable e-commerce platform. Most auditors 10 years ago still worked in a manual environment, and those using spreadsheets where considered highly advanced. Imagine an auditor today not “accepting” work on Sarbanes-Oxley, or not having upgraded his technical skills beyond the AS-400. They would be out of work. In a nutshell, to stay employable the auditor must be able to dynamically accept and understand the tools, processes, political realities, economics, new practices and limitations adopted by the general society, the auditing field and specifically the business world, as they progress through time. Some folks call this “having an open mind to change.”

2) Accept that the meaning of “Auditor” is in flux, and in the process of being redefined. It is my opinion that today the best auditors are those who unofficially wear about 4 hats at the same time. The first hat is the traditional hat worn by the typical CIA or CISA, which is focused on control frameworks and controls testing. Then the risk management hat, which is for auditors a “light version” of the work done by the PRM or ARM folks; dealing with formal risk assessments, reporting and analyzing impacts at the operational and IT levels. Then there is the compliance hat, which auditors can not avoid since they are the ones testing the controls that either pass or fail compliance. So, they often have to perform some sort of unofficial duties helping the compliance officers, or when there is no compliance officer, leading the compliance / remediation efforts in some fashion. The fourth hat worn by most auditors is the Governance hat. In the past, this hat was a small one, but now its gaining in size. Both corporate and IT governance have experienced fast changes since Sarbanes-Oxley was passed, stockholders became more demanding (in last 10 years) and internationally accepted frameworks have been accepted as legal and operational practices. The need for governance advisers by boards and the “C” levels, have allowed many auditors to fulfill this role given their traditional work with rules and regulations, policies and procedures. Next to corporate lawyers, auditors are the best positioned to work in the governance area. In my opinion, auditors who master these four areas are currently in high demand and will be so for a long time.

3) The IT challenge. My opinion is that IT Auditors need to get their CIA certifications and financial auditors need to get their CISA’s. This will take time for most people, but its not un-duable, specially for intelligent folks that are good at test taking. Most auditors by natural selection, are good at taking tests! Why do I feel this way? Remember we are talking about things that will make you most valuable for the future, and with the US economy shrinking, outsourcing, foreign competition and shorter employment cycles for most professionals, those who have the most diversity of skills and qualifications are better off than those who do not. If you look at the CIA material, a good two sections parallel with the CISA material. Study and get it done, period.

4) If you are a new CISA, I recommend that you focus your energies on two or three IT domains (IT Security, DR, SDLC) which you will make your “forte” for the next two to three years. Included in there should be strong knowledge of an ERP system like Oracle. Also, make sure you learn and become confortable with CobiT 4.1. If you are a new CIA, I recommend that you focus your energies on learning the IFRS and you position yourself as an expert in that area. Also, learn the COSO framework and get a good grip on risk assessments and the ACL analytics package.

The email from H. Dalad Wasi also asks how one can maintain a balance between IT and Financial auditing (since he is balancing the two). He is right in that few people can be masters of both. My answer is that one tends to gravitate for that which gives you the most satisfaction and where you find the greatest recognition and compensation from a social, financial, political and family perspective. If you are a nerd dressed up as a auditor, this will influence how you make this decision. But, if you’re an auditor forcing yourself to understand TCP/IP and router tables, this will also influence your decision. When I say that auditors should be both IT and financial auditors, I do not call for supermen or superwomen who are complete experts in each domain. Strong expertise in one domain and working knowledge in the other is sufficient to give you the competitive advantage needed.

This was intended to be a short reply, but it grew into something bigger. I also suspect I’ve missed some key issues, but for now this is my advice and I hope it was helpful to H. Dalad Wasi and others reading it.

If readers have ideas or suggestions for Mr. Wasi, please feel free to leave them here in the “Comments” so we can all contribute.

Categories: Audit, Human Resources, Jobs, Training and Certifications Tags: Human Resources, IT Audit, Jobs, Training and Certifications

Older Entries

Today's Audit Journal

WikiLeaks, Censorship and the Right to Publish

Book Review: “Managing the Audit Function” by Michael P. Cangemi and Tommie Singleton

Auditing Career: Dealing with Mentally Unstable Managers

Book Review: “The New Data Imperative: Managing Real-Time Risk in Capital Markets” by Dr. Raj Nathan, Irfan Khan, & Sinan Baskan

Response from Senator Bob Menendez to the “Dumb Auditor” Article

Response to Comments from the “Dumb Auditor” Article

Auditing Career: Do “Dumb Auditors” have more Professional Longevity than “Smart” ones?

New from DRII – Certified Business Continuity Auditor (CBCA) or Certified Business Continuity Lead Auditor (CBCLA)

Enterprise Security: Cheating on Your IT Security Audits

Auditing Career: Traveling to Dangerous Places

A Painful Lack of Security Jobs

Auditing Career: How to Focus on High Value Skills

Email Subscription

Recent Posts

Recent Comments

Archives

Categories

International

From AuditJournal’s Twitter

US-CERT Alerts

From Harvard Law School

From the SANS Institute – Training

From NIST

From Threatpost – Cloud Security

From Risk Management Monitor

From The Hacker News

From Wikileaks Twitter

Blog Stats since September 19, 2009

Blog Management

Related articles by Zemanta

Related articles by Zemanta

Related articles by Zemanta

Related articles by Zemanta

Related articles by Zemanta

Related articles by Zemanta

Related articles by Zemanta

Related articles:

Email Subscription

Recent Posts

Recent Comments

Archives

Categories

International

From Wikileaks Twitter

Blog Stats since September 19, 2009

Blog Management