![](/i/fill.gif) |
![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
On Thu, 03 Jul 2008 16:39:11 +0100, Invisible wrote:
> It just annoys me when some manager says "we should do X". And I
> carefully explain "X is a bad idea because of A, B, C, D, E and F". And
> the manager says "...yeah, well, I don't think those are problems". I
> mean, WTF can you say to that??
"Why don't you see those issues as problems?"
Then point-by-point, explain why A is a problem, B is a problem, and so
on. Discuss these points with them, don't just give up because they said
"I don't think that's a problem".
For example, if you point out A is a regulatory problem and they say it's
not, ask them how they would explain that to a government auditor,
because that's part of your job, so you need to be able to explain it -
and if you can't, you'll send the auditor to him instead. Not as a
threat, but because management identified it as a non-issue and you don't
understand why, so you'll have to refer the auditor to someone who *does*
understand why.
Jim
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
On Thu, 03 Jul 2008 09:24:01 -0700, Darren New wrote:
>> Or when I say "I need to do X", and they say "nah, I don't think that's
>> necessary". Er, well actually, yes it is. But hey, they're not the ones
>> who are going to get screamed at when the auditors can. I am.
>
> Again, "isn't that part of the legal requirements outlined in section
> XYZ of the how-to-make-auditors-like-you manual?"
And then again, you can always take the auditor to them after explaining
to the auditor "Tom here in my management chain doesn't see this as an
issue - perhaps he can explain why better than I can.". Then take the
auditor to see Tom.
Next time, Tom is more likely to give an explanation. Of course, he may
also get mad because Andy brought the auditor to him in the first place,
at which point it's appropriate to say "you didn't answer my questions
about this well enough that I could explain it to the auditor, so how
could I answer the auditor's questions? I can't just make something up."
Maybe Andy should get a job with the auditors instead. <eg>
Jim
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
> And then again, you can always take the auditor to them after explaining
> to the auditor "Tom here in my management chain doesn't see this as an
> issue - perhaps he can explain why better than I can.". Then take the
> auditor to see Tom.
Not easy when Tom lives on a different continent in a different time
zone. :-P
Auditors are always singularly unimpressed by "well X told me to do it
this way". They expect *me* to realise that this isn't good enough and
*force* the other person to understand this.
> Maybe Andy should get a job with the auditors instead. <eg>
Muhuhuhu!
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
>> Poor decisions are one thing. When you carefully explain why a
>> dicision is bad, and you get a reply that says no it isn't - no
>> explaination, just "I think you're wrong" - it's rather irritating.
>
> You can always ask for an explanation.
Well we're not doing that at any other sites, so I don't think it's
necessary.
[Never mind that "other sites" have more than 1 member of IT staff...]
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
On Fri, 04 Jul 2008 09:10:42 +0100, Invisible wrote:
>> And then again, you can always take the auditor to them after
>> explaining to the auditor "Tom here in my management chain doesn't see
>> this as an issue - perhaps he can explain why better than I can.".
>> Then take the auditor to see Tom.
>
> Not easy when Tom lives on a different continent in a different time
> zone. :-P
That's what the phone is for. Or if it's the middle of the night (though
you have managed to call "Tom" in the middle of the night before), give
his number to the auditor along with the time zone offset.
> Auditors are always singularly unimpressed by "well X told me to do it
> this way". They expect *me* to realise that this isn't good enough and
> *force* the other person to understand this.
Auditors understand that often times the person they're talking to
doesn't have the authority to do things the way they want, and if the
orders are coming from above to do things in a way that's not compliant
with the regs, then that needs to be disclosed during the audit.
Otherwise it *is* your ass on the line. It's not about shifting blame,
it's about holding the decision makers responsible for their actions.
That's why audits happen.
>> Maybe Andy should get a job with the auditors instead. <eg>
>
> Muhuhuhu!
You laugh, but that might not be a bad option. You know the regs, you
know what should be done and how it should be done, and you know that it
isn't being done that way. You want your current management to listen to
you? Become *their* auditor.
BTW, you don't have to change jobs to do that. If making sure things are
done in compliance, then you put together a pre-audit audit that goes
over the checklist the auditors will, and do a "dry run". Ask the
questions of your management that the auditors are going to ask you.
Hold them accountable. Then take the results from your own internal
audit and compare to the results of the external audit, put them both in
a report, and send it up the chain and highlight the areas where the
audit result was what you predicted, and outline what needs to change in
order for things to become compliant.
I used to have to do license auditing when I was the customer - we had
auditors from Ernst & Young come in once a year to audit our license
usage for a couple products that I was responsible for. There were times
I was asked to "fudge" the numbers a bit because of a recent layoff (for
example); I did everything up front with the auditors, told them that we
had a layoff but our policy was to retain the user accounts in a disabled
state for 60 days, just in case the employee was rehired (as a means of
preserving their access to resources), but that the vast majority
wouldn't come back. We just couldn't predict which ones would be
rehired. Rather than hide those accounts from the audit, I asked for an
exception. And got it from the vendor.
The auditors commented every year that they appreciated our approach -
they were typically in and out in less than a day. Other customers they
had to spend 3 or 4 days trying to get the audit done, and it was like
pulling teeth. I always figured if I could facilitate the audit and make
it go smoothly, I could get the auditors out of our hair quickly, and I
was right. We never paid for users we weren't using, and everyone was
happy.
I know your audits aren't license audits, so things are a bit different,
but if you work to make it non-confrontational with the auditors, they'll
appreciate it and make your life easier, generally speaking.
Of course there are pricks in every field, and auditing is no different
in that respect.
Jim
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
On Fri, 04 Jul 2008 09:12:01 +0100, Invisible wrote:
> Well we're not doing that at any other sites, so I don't think it's
> necessary.
"Well, regulation 10.3.723 subsection b, paragraph 6 says it is required
when there's only one IT staffer at the site. Since I'm that person
here, we need to meet that requirement, unless there's an IT staff member
I'm not aware of here - and I don't think that's the case, because I'd
know. Either way, the auditors are going to be looking for compliance
with this regulation, so how do you suggest I answer their questions
about why we're not compliant?"
Jim
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
>> Well we're not doing that at any other sites, so I don't think it's
>> necessary.
>
> "Well, regulation 10.3.723 subsection b, paragraph 6 says it is required
If only.
The regulations only say that backups have to be taken every day.
If I make too much of a fuss about it, the head IT people will probably
just nominate some random person and promote them to be a member of IT.
(Despite the fact they have no clue what they're doing.) And then I'll
have solved one medium problem and created a large problem...
This is always the worry - rather than do the simple and easy thing that
completely solves the problem, they always want to do something more
complicated that generates new problems. I really hate it!
Still, with a little unauthorised access to centralised systems, I was
able to sort this particular problem out without their help. "The"
sysadmin may be God, but when you have several of them things start to
get... interesting.
(Wasn't there a Pratchey book gooded "small gods" or something?)
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
On Fri, 04 Jul 2008 10:42:33 +0100, Invisible wrote:
>>> Well we're not doing that at any other sites, so I don't think it's
>>> necessary.
>>
>> "Well, regulation 10.3.723 subsection b, paragraph 6 says it is
>> required
>
> If only.
>
> The regulations only say that backups have to be taken every day.
>
> If I make too much of a fuss about it, the head IT people will probably
> just nominate some random person and promote them to be a member of IT.
> (Despite the fact they have no clue what they're doing.) And then I'll
> have solved one medium problem and created a large problem...
So then you step up pointing out the issue. Has the person been properly
trained? Do the regs require any specific training for the additional
person? What is the financial exposure to the company if the audit is
failed because of inadequate training, or if the backups fail and
critical data is lost?
> This is always the worry - rather than do the simple and easy thing that
> completely solves the problem, they always want to do something more
> complicated that generates new problems. I really hate it!
It's sometimes hard to do, but don't worry about what might be. You can
spend years thinking up worst-case "what if" scenarios and let that
prevent you from solving an immediate problem. Deal with the problems
you have, not with the problems that might be.
And on that note (and pardon the total non-sequitor here), I realise I
have to take my own advice here so I *can* get some sleep. (Without
getting into details, I learned about a potential really really bad
health issue today in my family, but there hasn't been a diagnosis yet,
but I've been worried absolutely sick about it all night = dealing with a
problem that *might* be, rather than waiting for a diagnosis to be made
by a qualified doctor. Yes, it's time I take my own advice on this one.)
> Still, with a little unauthorised access to centralised systems, I was
> able to sort this particular problem out without their help. "The"
> sysadmin may be God, but when you have several of them things start to
> get... interesting.
Yep, they do. Especially in a distributed environment. There are
certain operations that require centralised control. The trick is in
knowing which ones are.
Be careful about using unauthorised access, though - it can bite you in
the ass if things go wrong.
> (Wasn't there a Pratchey book gooded "small gods" or something?)
Might've been.
Jim
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
Invisible wrote:
> It just annoys me when some manager says "we should do X". And I
> carefully explain "X is a bad idea because of A, B, C, D, E and F". And
> the manager says "...yeah, well, I don't think those are problems". I
> mean, WTF can you say to that??
>
> Poor decisions are one thing. When you carefully explain why a dicision
> is bad, and you get a reply that says no it isn't - no explaination,
> just "I think you're wrong" - it's rather irritating.
>
> Or when I say "I need to do X", and they say "nah, I don't think that's
> necessary". Er, well actually, yes it is. But hey, they're not the ones
> who are going to get screamed at when the auditors can. I am.
>
As I read the posts it occurred to me that there is another aspect of
the situation.
How are you perceived at being able to do your job?
This isn't about your actual capabilities, it is what you are able to
project to the manager.
If your manager sees you as young, immature, or unconfident, he may
dismiss your expert views.
If your manager sees you as smart and confidant your wildest suggestions
may be taken without question.
I know I struggle with this.
Tom
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
Tom Austin wrote:
> How are you perceived at being able to do your job?
>
> This isn't about your actual capabilities, it is what you are able to
> project to the manager.
That's probably it, you know.
The current set of IT managers are less egocentric than their
predecessors, but still tend to ignore any outside input - I kind of
"I'm the expert, I know best" attitude. Who knows, maybe that's how they
got to be put at the top? Non-experts can't tell how good they "really"
are, only how confident they seem...
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |