A colleague of mine is doing some testing for an audit director that changes her mind frequently on how to deal with audit findings. Occasionally, she is all about nailing control owners who do not have all their ducks groomed and in a row. At other times, she pushes Audit to work as hard as possible to pass all controls.
Most of the time, neither the manager or the director reviews any of the controls after testing is completed, so my colleague often wonders how much the audit opinion matters one way or another.
One auditor, noticing the dilemma, remarked:
If you pass the control, no one will look at it.
But if you fail the control, the manager will change it to a pass, and then no one will look at it.
ITauditSecurity 