4

I work as an IT auditor in a lead / mentor role for members on my team. We communicate frequently with management about recommendations to remedy security weaknesses discovered in reviews or audits.

As the end goal is for management to take action to mitigate risks exposed, the recommendations should be practical and actually achievable by the company. I have discovered that team members are recommending actions after the audit has completed in the audit report that are not feasible for management to implement, taking into account business needs. Examples of constraints are technological inadequacy, and resource shortages in terms of number of available employees and time.

I would love to see some of the recommendations given by my team members to be implemented in the future but right now is not feasible. I fully agree these are best practices but recommendations should be realistic, cost effective and be a value added function.

I am not sure how to discuss this problem with the team. On one hand, I don't want to dampen their enthusiasm in recommending solutions, but on the other hand, it is important to understand the business environment when recommendation remediation steps.

How can I help team members become more aware of business needs when making recommendations to management?

  • 5
    I'm not sure I agree with the premise...is the purpose of an audit not to objectively assess whether or not certain standards are being met? You can't make those standards more flexible just so the audited party can more easily meet them, that would seem to defeat the purpose. – Cronax Mar 8 '17 at 8:35
  • 1
    I agree with Cronax - finding and documenting problems will often have value, even if you cannot fix them all. Could you explain why you feel that "auditing simply for the sake of picking apart problems" is not helpful? – sleske Mar 8 '17 at 9:36
  • 1
    Also - what is your goal? What is the desired result of "team members becoming more practical in their thinking"? Less problems reported in audit? Better categorization of problems? Directly discussing business impact in the report?... ? – sleske Mar 8 '17 at 9:38
  • @Cronax security is about being realistic too, recommand the "perfect security system yet no one will ever implement it" have a very little use. The result of an audit may not show only one (utopic ?) goal but eventually intermediary goals in order to fix what really need to be fix in a short term objectives and fix a long term objectives. – Walfrat Mar 8 '17 at 9:59
  • 1
    Last time I heard that things like unit testing, documentation and sound technology are not practical due to resource shortages in terms of number of available employees and time, team quit. Months passed and as far as I know team was not rebuilt. Some things are now outsourced, other done by ex-boss (who now have no employees), others yet not done at all. So please reconsider, what might cost more. – Mołot Mar 8 '17 at 13:29
4

What are some steps I can take to have team members become more practical in their thinking?

That depends on why they aren't currently providing the desired outcomes now.

If these team members know that only practical recommendations should be provided and they know how to provide practical, rather than idealistic, solutions, then they simple aren't doing the job that is required. They should be mentored individually, in private. Their shortcomings should be pointed out. They should be told that they must correct their actions. And if they still don't then they need to be removed from their positions.

On the other hand if they don't know that only practical recommendations should be provided, then you need to explain that to them. Talk to them about the difference between idealistic and practical. Explain why only the latter is appropriate. Then follow up to make sure they understand and are following the expectations.

If instead they know that practical recommendations are required but don't know how to produce them, then you need to set up one or more training sessions to teach them how to produce the results you want. One way to train them would be to pick specific situations they could encounter, explain the ideal solution, then work together to brainstorm practical solutions. Again, you need to then follow up to make sure the trainings are implemented properly.

Some internal audits provide two types of output - the ideal and the practical. I have read audit reports like this. They provide a long-term goal of approaching a more ideal situation, while providing shorter-term, more practical remediation requirements. You may wish to explore that as a way to satisfy the auditors' understandable need to point out the "really great" solutions while giving the department the more achievable solutions they need now.

7

I worked for an audit agency for 5 years. What you are suggesting is a very bad thing and goes against the purpose of an independent audit. It is interference by management in the findings. I would suggest you read about the Enron debacle to see why this is a terrible idea on your part. Your team is behaving correctly and you are not.

It is not for the people doing the auditing to determine if the recommendations are currently practical. It is up to management to respond to the audit and explain why they cannot do certain things at this time. It is solely the purpose of the audit team to identify deficiencies and then make recommendations to fix them. If you are interfering with your team doing that then you should be fired. Auditors are NEVER supposed to be influenced by what management outside the audit team want.

  • 2
    All audits are supposed to be independent. All auditors are supposed to be independent or they are useless. – HLGEM Mar 8 '17 at 16:25
  • @JoeStrazzere - All audits should be independent, but they still be internal (work for the same company). When this happens, ideally they report either to an independent body (such as an audit committee) or to an appropriately high-level executive. – indigochild Mar 8 '17 at 21:26
  • 1
    I'm not sure this answer gets to the problem. The person asking the question identifies themself as a lead auditor - they are not the auditee's management and they are a part of the audit team. Audit recommendations are intended to address the root cause of findings - if the recommendation can't be implemented, it's likely the audit team didn't do a good job of establishing the root cause of their problem finding. – indigochild Mar 8 '17 at 21:32
  • 1
    @indigochild I don't agree. The auditor's job is to report the problems, and not figuring out if the management can implement it or not. Any solution can be easily shot down by management with "we don't have the budget for that", that does not mean the auditor should drop the problems altogether from the report. Unless the audit is specifically a finance audit, the auditors should not jump into the company's finances to find out why budget is the constraint. – Masked Man Mar 9 '17 at 4:19
  • While I agree that reporting long objectives yet maybe not possible is part of audit job, I think it would be part of the audit to indicate some short-term solutions to the most critical problems too. Finally if the audit team is only producing recommandation that no one implements, they won't maintain that team long ... – Walfrat Mar 9 '17 at 8:30
0

I think you need to engage them more like project's manager with their idea.

As such I would engage them more seriously into each idea(s) with question like; "How we will do it ?" "How much time it will take ?" "Who will do it ?" "Can it fit in our process ?", etc..

To give an example: In one enterprise I was in, when someone used to bring an idea the one giving it needed two bring two positive points to back the idea.

That way to do was to make them think outside the box, thus if their ideas would really bring plus value, then it could be integrated into existing process easily, else the idea will not survive anyway.

On another note, good sign if the enthusiasm is there, it's sign of a healthly's team in my own opinion.

-1

I took a management class from a man that ran the production of the U.S. F-16 airplanes. He had a very wise expression in his closing slide.

If an employee is not doing their job (including being practical) then determine

  1. Are they capable and need to be trained? If so, train them yourself or get resources to have them trained.
  2. Are they unable for some other reason? If so, have mercy on them and find them another position inside or outside of the company.
  3. Are they unwilling? Fire them without mercy

A business has no place for employees that won't do their job. In the most polite way possible, I start the conversation with "are you happy here?". If they are not I seek out why they are not happy. If they really don't like their job, I encourage them to find work elsewhere. I literally make suggestions for other industries or companies. Often it is a combination of culture and the direction of the company.

For example, a person wants to be creative and think up new ideas, but the company really can only take on one direction. When the company doesn't have the resources to go explore, the employee really needs to find a new job at a business that has R/D resources.

Recognize when you have a square peg in a round hole and address it. Don't hold out hope that they will change.

  • 1
    If think this answer is jumping to the conclusion that "an employee is not doing their job". To me it looks more like OP (or the employees boss) is not adequately explaining what is expected during an audit. That should be addressed first. – sleske Mar 8 '17 at 9:42
  • 1
    The auditors are doing their job, he is trying to interfere with that. – HLGEM Mar 8 '17 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.