Hacker News Reader

Quarterly audits are very much out of the norm among SAAS startups. Checklists that don't reflect reality don't help anybody --- but then, I guess I don't think this checklist does, either.

View on HN

> but then, I guess I don't think this checklist does, either.

Why do you say that? Do you think the items on the list are not useful/well prioritized? Or that most companies are not positioned/incentivized to follow most of this advice?

We use tools for automatic continuous assessment against a bunch of standards. They're not perfect but they help separate the signal from the noise immensely.

Continuous assessment is good (tool-driven continuous assessment can be sketchy), and is a norm at larger tech companies. Quarterly 3rd party assessments aren't, even at large companies (big companies might get many more than 4 audits per year, but will not as a rule re-assess things more often than annually or at major revisions).

Reply on news.ycombinator.com