More Snake Oil

In Standard (Snake) Oil, I complained about  companies that don’t audit according to standards because some treat control owner statements as pure gold, don’t insist evidence be tied back to actual systems, and don’t ask all the appropriate questions.

Here’s a few more questionable practices that I’ve challenged all too recently.

It’s not Business, it’s Personal

I wonder sometimes how many controls fail due to personal issues instead of design and performance issues. In other words, do controls fail more because of communication, turf, and personal issues or is it that the control is poorly designed or not performed?