I'm just looking through one of the audit reports from a customer audit 
team. It's quite an amusing read, really.

The first page says who, what, where, why, etc. Then the summary says 
that "these guys are OK to do work for us", before the following 25 
pages detail over 75 deficiencies identified in our work. That just 
struck me as a little comincal. ;-)

I should probably get back to rectifying the IT-related deficiencies 
now... Possibly using a diode bridge. ;-)

Post a reply to this message

On 20-2-2009 12:27, Invisible wrote:
> I'm just looking through one of the audit reports from a customer audit 
> team. It's quite an amusing read, really.
> 
> The first page says who, what, where, why, etc. Then the summary says 
> that "these guys are OK to do work for us", before the following 25 
> pages detail over 75 deficiencies identified in our work. That just 
> struck me as a little comincal. ;-)
> 
> I should probably get back to rectifying the IT-related deficiencies 
> now... Possibly using a diode bridge. ;-)

How many of those were you aware of, but were prevented from changing?

Post a reply to this message

>> I should probably get back to rectifying the IT-related deficiencies 
>> now... Possibly using a diode bridge. ;-)
> 
> How many of those were you aware of, but were prevented from changing?

Only 3, really. (There's about 10 IT-related deficiencies reported.)

I don't know if you've ever experienced this, but, see, auditors have 
this magical ability. No matter how properly you think you're doing 
something, some auditor will *always* come up with "why didn't you do 
X?" And you think to yourself "hey, actually... yeah, we probablt should 
have. Crap. I never thought of that."

Also, if there's one instance where a procedure wasn't followed, the one 
case that the auditors randomly select will be *that one*. And they will 
then refuse to believe you that the thousands of other cases just like 
it were carried out correctly and tha this is an isolated incident.

Auditors are scary. ._.

Post a reply to this message

On 20-2-2009 12:32, Invisible wrote:
>>> I should probably get back to rectifying the IT-related deficiencies 
>>> now... Possibly using a diode bridge. ;-)
>>
>> How many of those were you aware of, but were prevented from changing?
> 
> Only 3, really. (There's about 10 IT-related deficiencies reported.)

Three is not bad.

> I don't know if you've ever experienced this, but, see, auditors have 
> this magical ability. No matter how properly you think you're doing 
> something, some auditor will *always* come up with "why didn't you do 
> X?" And you think to yourself "hey, actually... yeah, we probablt should 
> have. Crap. I never thought of that."
> 
> Also, if there's one instance where a procedure wasn't followed, the one 
> case that the auditors randomly select will be *that one*. And they will 
> then refuse to believe you that the thousands of other cases just like 
> it were carried out correctly and tha this is an isolated incident.
> 
> Auditors are scary. ._.

It is called experience.

Post a reply to this message

>>> How many of those were you aware of, but were prevented from changing?
>>
>> Only 3, really. (There's about 10 IT-related deficiencies reported.)
> 
> Three is not bad.

Well, no. Suffice it to say that none of the deficiencies are actually 
related to how our computers are set up. They're all related to 
paperwork (or lack thereof).

You might recall that when we moved buildings, the guys from the USA 
came over and basically took over the place for a week, moved everything 
around (despite me telling them, to their faces, that they should stop), 
and then they went home and told me to write up some documentation. 
Apparently the auditors weren't too impressed with the complete lack of 
testing. I wasn't thrilled either, to be honest. But hey, it's not the 
guys from HQ who get moaned at; it's me.

On the other hand, people claim that the regulations are just common 
sense codified on rigorous form, but some of the things these auditors 
want us to do are anything but common sense. For example, just because 
our servers are in a different room now, they want me to "test" them. 
Quite what I'm supposed to test I don't know. I fail to see how picking 
up a server, moving it from A to B, and turning it back on again is 
supposed to change the way it functions, but still...

>> Auditors are scary. ._.
> 
> It is called experience.

I see...

Post a reply to this message