She left after a colleague who apparently spent most of his time asleep in a cupboard got promoted over her....
NB It was financial auditing not IT.
Leaving was the best option that your wife had, in such a case you really don't want to stick around until the house burns down.
To make gov agencies happy? Or investors? -- who are those who care
(And good if they do mostly nothing)
Best plan for everyone is to get out of shady companies like that ASAP.
Ok so that's not how things usually work?
In most? companies internal auditors do real work, would you say? (I'm clueless)
For the individual auditor: if you're a chartered/certified accountant you can get into a lot of hot water, including possible jail time.
With this situation, there is a reasonable expectation for EY to lose clients. Partners will also face some consequence. Most likely they will be let go and removed from accreditation by CPA (in the US). There are several high profile cases where partners get sacked[0].
[0]: https://www.ft.com/content/5179fb94-fd6c-11e8-ac00-57a2a8264...
As for the guy sleeping in cupboards...the staff at those firms reguarly work 80 hour weeks (not the "I work 80 hour weeks counting all kinds of stupid things" but the "I was at the client site or in the home office for 80 hours this week". It was a very common occurence for hard working staff members to take naps at the client (most likely because last night was a 2am night). Promotions at these firms are often very competitive as the organization is an "Up or out" organization designed to chew up fresh college grads.
The peer review is conducted by an independent evaluator, known as a peer reviewer. The AICPA oversees the program, and the review is administered by an entity approved by the AICPA to perform that role. 2. The peer review helps to monitor a CPA firm's accounting and auditing practice (practice monitoring).
That's a big claim for you to make given that you don't know the company, the size of their clients, or even whether or not anyone went to jail over the proceeding decades.
I would also ask myself how far the rot went, because if (for example) this organisation was also supposed to audit the government and yet promoted those who “slept in a cupboard” over those who worked diligently, then I would expect the country to suffer a very large and very surprising economic disaster.
That said - don’t despair! The purpose is NOT to catch purposefully-fraudulent CFOs. That’s the SEC’s job. It’s much more of a forcing mechanism for otherwise-honest CFOs: they know they have to justify what they’re doing somehow, and the auditor knows that if something will inevitably blow up anyway, they can’t sign off. So it just arrests the slippery slope when honest mistakes are made.
What does that mean? Not a native speaker, dictionary not so helpful
While “arrest” normally means a police officer putting someone in handcuffs, it is derived from derived from the French word “arrêt“ meaning 'to stop or stay', and can still be used in that sense.
Thus, “arrest the slippery slope” means “prevent bad behaviour”.
In the end I implemented both my solution and his. Mine worked like a charm, his literally caught on fire (it was power electronics development). Got fired anyway...
Just say "yes", and work on your job-hunting instead.
Makes me slightly wonder if the manager had hidden motivations and didn't want the project to succeed
The manager was one of the company owners, so he was well motivated, but he was an academic with little world experience that though he knew better than the industry.
A lot of these auditors come from a financial background and they treat IT in much the same way, as if there is some kind of checksum they can calculate which will tell them if the company is healthy from an IT perspective or not.
Companies that are certified tend to be very good at process but are sometimes surprisingly bad at the actual IT. But it's all documented perfectly.
It is anything but boring to me.
That said, all the ISO standards are corporate moonspeak and bullshit themselves and do not bear any practical sense. (All that, for example, looong document on infosec ISO 27001 says is "try to be secure, my friend")
So as a rule we treat an ISO 27001 certificate not so much as a checkbox item meaning we can skip certain parts of our audit, but as a nice-to-have which may help speed up the interview process because we at least know what terminology to use.
In practice there is too little difference between companies with or without such certification to see it as anything other than a marketing tool.
Audit is really freaking expensive; Domain experts too. While there is a checklist that given to the auditor, the person asking those questions are usually senior or early manager level. The person has little experience in IT but usually has a small BS detector because of previous audits. That checklist is then sent to an internal domain expert to verify. Follow up questions may occur.
Having said that, this is strictly for compliance and “covering your own butt”. This past year a firm was found negligent because they didn’t catch fraud because they simply “checked the box”. Since then, most firms have introduced rudimentary IT training for auditors responsible for said checklist. (All staff have to take the classes, when at level).
TL;DR an auditor cannot have same knowledge as IT person and audit time is expensive. They’re trained to earmark fraud and to verify, to the best of their abilities, they are not signing off on a lie. Shit is hard and no system is perfect.
1. The Public Company being audited isn't going to spend money on a real technical audit and may in the future lose customer info, etc.
2. The financial auditing company doesn't have enough experience to properly asses the situation. They did the best they could but they're no experts.
Code audits and pentesting are a thing you can buy. But yes, they're even more expensive. Turns out security isn't considered valuable enough for most.
They have no proficiency or enough people who know what they're doing. The approach is to meet the lowest common denominator set by the SEC or is expected from investors.
You can fake all of this. But at some point its easier to do the job than to fake it. Well at least this is what I hope...