7

I know auditing is done to help the company improve. I work at a software company, and I overheard my boss saying that he knows how to handle an auditor by giving extremely long and time consuming answers to any small question the auditor asks. The auditor was doing an audit of our information security.

Even at my previous company, when an auditor was accessing the LAN network and doing some audits, my boss there was talking (jokingly) of throttling the network speed of the LAN the auditor was working on.

Another instance: I think I saw this in a TV serial, where the AC was turned on to be too cold in the room auditors were seated.

Is it common for workplaces to make an auditors job uncomfortable (even if the auditor is a good, diligent person) or to deliberately stall or drag their work so that they'd ask very few questions, wrap up and get out ASAP?

Is this one of the "smart manager" corporate things to do? If it is, and is appropriate, what are the best ways to do it?

Update: Note that this is not a situation where the people in the company are trying to trick or hide information from the auditor. These are very intelligent people who know what is good for the company, and are already complying with rules. They just find it an annoying, boring process to be put through the ordeal of answering questions from an auditor. So they make it boring for the auditor too, so that (s)he'd ask fewer questions and complete the audit quickly. The belief at their end is that if they give the auditor a free rein, then the auditor (especially the meticulous ones) will just keep going into more annoyingly boring details which might not even be necessary.

  • 11
    All your boss or previous bosses were doing is making another person's job and livelihood that much harder...usually because they are hiding something they know they are not supposed to be doing. I know auditors who could make life a living he** if someone pulled those kinds of childish actions. The auditor, depending on the industry/regulations, can actually say to the company that your boss in not showing competency in his job by giving long answers to simple questions. He could also start nitpicking as there is always a violation available. – B1313 Jun 25 '16 at 17:09
  • 6
    Auditors aren't stupid. If someone is deliberately trying to stall or make them unconformtable, that will raise all kinds of red flags and trigger more digging. – Laconic Droid Jun 26 '16 at 1:51
  • 2
    "my boss there was talking (jokingly) of throttling the network speed of the LAN" - people make jokes all the time that don't reflect reality at all. If he was actually intending to take this action, he almost certainly wouldn't have joked about it. Your other "instance" that you mentioned is from a comedy television series, so is clearly a joke. Do you have any actual instance of this occurring? – Brandin Jun 28 '16 at 8:13
  • 1
    Having worked for an audit organization, most good auditors would see this sort of thing as a signal that there is something to hide and dig deeper. – HLGEM Jun 29 '16 at 15:29
  • @Brandin My supervisor at the current workplace gave long answers to the auditors questions and as I've mentioned in the first sentence, I later overheard him confirming it. – Anon Jul 4 '16 at 16:06
24

The auditor is there to help your company comply with reasonable rules. It is unethical, and depending on what is being audited for may put the company in serious legal jeopardy, to deliberately make their job more difficult.

This is an incompetent manager. On a TV show, where reality is optional and the authors can guarantee the idiot isn't caught, it may work. Real life doesn't work that way.

If you can't pass an audit without cheating, you have not been doing your job. If you cheat, you are begging not just to be demoted but to be fired. If you get the company sued, expect them to share the pain.

The zeroeth commandment applies here: Don't Be Stupid.

  • 1
    The auditor is there to help your company comply with reasonable rules. in an ideal world. – Myles Jun 28 '16 at 15:14
  • 1
    Getting caught trying to fudge. an audit would be much worse that simply not passing . – keshlam Jun 28 '16 at 16:22
13

As an IT auditor myself this behavior is unprofessional and unethical. My job when doing internal audits or an external audit for a client is to help them improve, and not to harm the business I am auditing.

The business would certainly want to know about serious risks or deficient processes that endanger the business. As an example, by reporting to management that privileged access control is weak, or software change management is is inadequate through tangible evidence gathered from testing, I am doing a valuable favor to my client.

I am bound by my profession' guidelines regarding Evidence and per the guidelines, in the case I am not able to obtain sufficient evidence for the basis of my opinion due to non cooperation of the auditee, I must attempt to obtain evidence by other means if possible and disclose to management. Management should be reasonable to understand that by deliberately hindering my work, I will be digging deeper for the information I requested.

It is a non - disputable fact that the business wants to survive. My goal is to assist them by bringing to light obstacles that hinder the business meeting their ultimate goal of survival. Non cooperation only hurts the management of the business - an irrational decision.

  • What I mentioned is not a situation where the business wants to trick or hide information from the auditor. They just find it a boring, annoying process to be put through the ordeal of having to answer questions from an auditor, so they make it boring for the auditor too, so that (s)he'd just ask fewer questions and complete the audit quickly. – Anon Jul 3 '16 at 17:44
3

It's not appropriate to do this, but mainly because it's a passive-aggressive approach to addressing a problem.

I've worked for companies going through all kinds of audits, and to be honest, auditors charge by the hour. Some of them are professional but others like to spend a lot more time than they need to. I worked for one multinational that finally got so fed up with their SOX auditors, after providing everything needed for months (and even hiring a large temp staff just to feed them information), they finally had to say "you're done now. Pass us or not, but if not we'll get another firm to do the next one." Suddenly, we passed.

What you need to do is to understand what kind of time is reasonable and customary for a given audit and then ask for a clear list of everything needed and timetable from the auditor. Don't accept 'well, I won't know till I know, let's just fish till we're done.' The list of deliverables should be completely delivered day one, and sure, if you can't provide them that's on you, but at least the slippage has a clear cause in that case.

Most of the time, this kind of messing with people is a poor man's substitute for actively managing a real problem.

2

Is it common and appropriate to “throttle” an auditor?

Generally no, it's neither common nor appropriate in most places.

It also depends on whether it's an outside audit or internal. Usually any attempt to interfere with an internal audit is dodgy at best.

In some places interfering with outside audits is more understandable, particularly in the third World where corruption is rife and the auditors can have totally different agenda's to their supposed role and may be moonlighting for a competitor or in business for themselves.

I recently had a govt Audit department in the third World audit my stuff via an email asking me to list assets and software. I guess they were too busy to show up in person.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.