Embrace the IT Audit

If you work for a publicly traded company, a bank, or a healthcare organization, chances are you've already come into contact with IT auditors from your company's internal audit department, public auditors, or some type of government regulator or examiner. Even small companies aren't exempt from the IT audit process. If you provide services for larger public or regulated firms, your business partners will want assurance that sufficient controls are in place to protect their interests and prevent exposing them to risk. To provide that assurance, you'll probably have to let the business partner's IT auditors or an independent firm perform-an audit of your IT controls.

The knee-jerk reaction by many IT pros is to resent or even resist IT auditors and their processes or, at best, view audits as a necessary evil. But you might as well embrace the audit process and reap as much value from it as possible. Depending on the auditors, you might be able to use an audit as an opportunity to improve security, policy, and technical controls. By cooperating with auditors and understanding the real business goals behind the audit, you could also preempt recommendations that are off target and a waste of effort. To better cooperate with IT auditors, it helps to understand what they're looking for and how they work. . . .