Software auditors such as KPMG, Deloitte and
PriceWaterhouseCoopers like to have things their way. It's an
understandable impulse – with likely hundreds of audits
pending at any one time, the natural inclination is to standardize
the process around a single set of tools and processes with which
the auditors are most familiar. However, those tools and processes
often are a poor fit for an audited business for any number of
reasons, some technical and some legal.
A good example is the practice of some auditors to request that
audited companies use one or more automated scripts – often
proprietary to the auditors – to gather network and system
data that they believe to be relevant to an investigation. In many
cases, the scripts are configured to generate output that is easily
read by other tools available to the auditors, and – when
they work – they typically gather information relatively
quickly and unobtrusively.
