IT AUDITS ARE NOT THE ULTIMATE ANSWER

So I had a question regarding audits making one secure. The question related to my article and post here Security Testing for Your SMB: What You Need to Know.

I will stick to my arena of experience in cyber with regard to ITSM and policy. Audits are good at pointing out flaws in your controls and compliance with regulations and standards.

However, in my experience, most audits are "gamed". Meaning organizations know they are coming, burn the midnight oil, and jump through the hoops to prepare for them, all because they weren't following policy and process, or don't have them in place at all.

What's your experience with audits of IT organizations?

Joe "Rhino" Brochin is launching ITSM RHINO in the coming weeks, it is the pull-no-punches, casual-but-effective resource for renegade IT Pros who want to manage risk and add value through ITSM processes & IT Policy.
GET IN EARLY!
Note: All graphics within this post, including their images and elements, were sourced and generated from Canva.com, except when otherwise identified on the graphic.