Audits in general are such a joke. Rubber stamping and checks done by students or graduates who barely understand what they are doing. And even if they detect something, it is considered as not material and ignored. From business perspective the auditors are clueless. I dont claim that audits are bad, they are very needed. But the execution in many ways is so poor.
All audits should be disclosed in giant black letter on the front “PAID FOR BY THE AUDITED COMPANY”
The conflict of interest in external audit is absurd. It’s similar to securities rated rating agencies paid to rate the instruments by the issuing company.
Look, these sentences are probably more than just and even on the light sight. Handing in your auditing license is a pretty severe punishment, at least career changing. But will the risk and audit professionals at BaFin face the same penalties?
If they do, they'll be tempted to rat out the political overlords who dictated the "see no evil, hear no evil" policy.
Look, these sentences are probably more than just and even on the light sight. Handing in your auditing license is a pretty severe punishment, at least career changing. But will the risk and audit professionals at BaFin face the same penalties?
Audits in general are such a joke. Rubber stamping and checks done by students or graduates who barely understand what they are doing. And even if they detect something, it is considered as not material and ignored. From business perspective the auditors are clueless. I dont claim that audits are bad, they are very needed. But the execution in many ways is so poor.
I once worked at a small pen-testing firm that also conducted PCI DSS compliance tests, and I can confirm that this is an accurate depiction of the industry. A majority of the staff were recent grads, and it was disheartening to see that most clients were primarily interested in obtaining the compliance certification rather than genuinely improving their product security. This, in turn, creates a perverse incentive for auditors to grant compliance, as clients who don't get the desired outcome may simply switch to a different auditor. In such a setup, it's difficult to ensure that security standards are genuinely upheld. On a positive note, these compliance tests do help in making sure that card data isn't stored in plaintext, but beyond that, the overall impact on security seems rather limited.
If a CEO mismanages and goes bankrupt, they cannot start another company for 5 years; a two-year ban seems mild, but better than nothing, as the reputational damage is substantial (why would any non-criminal pick EY afterwards in good faith if there are others?).
It would be an interesting idea to make auditors fully accountable like bankruptcy advisors.
I know, this is never going to happen.
Audits in general are such a joke. Rubber stamping and checks done by students or graduates who barely understand what they are doing. And even if they detect something, it is considered as not material and ignored. From business perspective the auditors are clueless. I dont claim that audits are bad, they are very needed. But the execution in many ways is so poor.
All audits should be disclosed in giant black letter on the front “PAID FOR BY THE AUDITED COMPANY” The conflict of interest in external audit is absurd. It’s similar to securities rated rating agencies paid to rate the instruments by the issuing company.
The audited company often buys consulting services from the auditors which in effect is an extra incentive on top of the moneys paid for the auditing service. The mechanism that allows this is the ‘Chinese wall’ but that is a total joke. What really need to happen is to separate out consulting from auditing. That’s not going to happen though as there is just so much money is consulting.
Audits in general are such a joke. Rubber stamping and checks done by students or graduates who barely understand what they are doing. And even if they detect something, it is considered as not material and ignored. From business perspective the auditors are clueless. I dont claim that audits are bad, they are very needed. But the execution in many ways is so poor.
> From business perspective the auditors are clueless.
Hey! I used to be a young IT grad helping with financial audits.
If it helps, I was young and clueless and frequently I still figured out more about the business processes I was auditing than the client employees taking care of them every day :-p