Is it common and appropriate to "throttle" an auditor?

Question

I know auditing is done to help the company improve. I work at a software company, and I overheard my boss saying that he knows how to handle an auditor by giving extremely long and time consuming answers to any small question the auditor asks. The auditor was doing an audit of our information security.

Even at my previous company, when an auditor was accessing the LAN network and doing some audits, my boss there was talking (jokingly) of throttling the network speed of the LAN the auditor was working on.

Another instance: I think I saw this in a TV serial, where the AC was turned on to be too cold in the room auditors were seated.

Is it common for workplaces to make an auditors job uncomfortable (even if the auditor is a good, diligent person) or to deliberately stall or drag their work so that they'd ask very few questions, wrap up and get out ASAP?

Is this one of the "smart manager" corporate things to do? If it is, and is appropriate, what are the best ways to do it?

Update: Note that this is not a situation where the people in the company are trying to trick or hide information from the auditor. These are very intelligent people who know what is good for the company, and are already complying with rules. They just find it an annoying, boring process to be put through the ordeal of answering questions from an auditor. So they make it boring for the auditor too, so that (s)he'd ask fewer questions and complete the audit quickly. The belief at their end is that if they give the auditor a free rein, then the auditor (especially the meticulous ones) will just keep going into more annoyingly boring details which might not even be necessary.

Answer 1

The auditor is there to help your company comply with reasonable rules. It is unethical, and depending on what is being audited for may put the company in serious legal jeopardy, to deliberately make their job more difficult.

This is an incompetent manager. On a TV show, where reality is optional and the authors can guarantee the idiot isn't caught, it may work. Real life doesn't work that way.

If you can't pass an audit without cheating, you have not been doing your job. If you cheat, you are begging not just to be demoted but to be fired. If you get the company sued, expect them to share the pain.

The zeroeth commandment applies here: Don't Be Stupid.

Answer 2

As an IT auditor myself this behavior is unprofessional and unethical. My job when doing internal audits or an external audit for a client is to help them improve, and not to harm the business I am auditing.

The business would certainly want to know about serious risks or deficient processes that endanger the business. As an example, by reporting to management that privileged access control is weak, or software change management is is inadequate through tangible evidence gathered from testing, I am doing a valuable favor to my client.

I am bound by my profession' guidelines regarding Evidence and per the guidelines, in the case I am not able to obtain sufficient evidence for the basis of my opinion due to non cooperation of the auditee, I must attempt to obtain evidence by other means if possible and disclose to management. Management should be reasonable to understand that by deliberately hindering my work, I will be digging deeper for the information I requested.

It is a non - disputable fact that the business wants to survive. My goal is to assist them by bringing to light obstacles that hinder the business meeting their ultimate goal of survival. Non cooperation only hurts the management of the business - an irrational decision.

Answer 3

It's not appropriate to do this, but mainly because it's a passive-aggressive approach to addressing a problem.

I've worked for companies going through all kinds of audits, and to be honest, auditors charge by the hour. Some of them are professional but others like to spend a lot more time than they need to. I worked for one multinational that finally got so fed up with their SOX auditors, after providing everything needed for months (and even hiring a large temp staff just to feed them information), they finally had to say "you're done now. Pass us or not, but if not we'll get another firm to do the next one." Suddenly, we passed.

What you need to do is to understand what kind of time is reasonable and customary for a given audit and then ask for a clear list of everything needed and timetable from the auditor. Don't accept 'well, I won't know till I know, let's just fish till we're done.' The list of deliverables should be completely delivered day one, and sure, if you can't provide them that's on you, but at least the slippage has a clear cause in that case.

Most of the time, this kind of messing with people is a poor man's substitute for actively managing a real problem.

Answer 4

Is it common and appropriate to “throttle” an auditor?

Generally no, it's neither common nor appropriate in most places.

It also depends on whether it's an outside audit or internal. Usually any attempt to interfere with an internal audit is dodgy at best.

In some places interfering with outside audits is more understandable, particularly in the third World where corruption is rife and the auditors can have totally different agenda's to their supposed role and may be moonlighting for a competitor or in business for themselves.

I recently had a govt Audit department in the third World audit my stuff via an email asking me to list assets and software. I guess they were too busy to show up in person.