|
Changing Roles
Until a few years ago, most IT auditing standards addressed only specific issues, such as how to gather, distribute and store data. An audit focused on "details first, like how a control is working," says John Carrow, VP and CIO for Unisys Corp., an IT consultancy based in Blue Bell, Pa. It overlooked big issues, like how a company makes decisions about whether to invest in certain IT projects.
As the CobiT standard has evolved, these issues have become auditable. Carrow sees this as a welcome change, because strategic issues are "part of the overall maturity process" of an audit. In general, midmarket companies that hire consultants for IT audits are unlikely to ask auditors to examine issues that aren't on the checklist for the standards they've chosen. But midmarket companies that have their own IT audit departments can use them in innovative ways.
Wescott, for instance, says he once helped a CIO who had a personnel problem: His help desk staffers weren't getting along with their manager. Rather than alarm everyone by bringing in human relations at the outset, the CIO asked Wescott to investigate team dynamics under the guise of conducting a help desk audit.
Wescott isn't sure whether help desk workers believed that the audit was real. At any rate, he conducted extensive interviews with staff and the manager. "The relationships were so broken that the staff was happy to talk," he says. "I didn't even have to ask questions. They just blurted it out. Their anxiety flowed out of them." Wescott took the information back to the CIO, who passed the issue on to HR. The manager was ultimately reassigned. That is an example, Wescott says, of how the CIO can use an auditor as a "secret buddy."
Joan Indiana Rigdon was a contributing writer for CIO Decisions. To comment on this story, email editor@ciodecisions.com.
|
 |
|
|
