David L. Dann

New Zealand

IT audit controller

I see this as a training and an insufficient resource problem. IT auditors are frequently called to audit applications and systems of which they have little familiarity. This has probably been the case since the days when it was called EDP auditing. Management does not feel remiss in not providing in-depth training of these systems for its staff. Still, those applications are professionally audited. But looking at a system to see that it has edit validation checks for user inputs is not quite the same as auditing perimeter defence such as firewalls and IDS where new vulnerabilities and threats are constantly emerging. Mgmt. also depends too much on auditors with general knowledge where subject matter experts are in order. Finally, audit staffs are hard pressed to keep up with the demands of government regulatory mandates such as SOX and industry self enforcement standards like PCI. Compliance with these does not equate to an enterprise having a better IT security posture.