Unfortunately, companies are all too reliant on the Big 4 for IT controls and miss some of the greatest areas of risks. Another white paper that may be of interest would be the one called “Accessing the Oracle Apps Database w/o a Database login.” This paper addresses the risks of SQL forms, one of the greatest under-discovered security risks in Oracle Apps.

My two cents…

-IJustWorkHere

IT audit and security professionals have a role at all points on the timeline for a major systems implementation:

1)Pre-implementation project plan and budget review to make sure controls priorities are established upfront and controls are given the appropriate amount of time and money.

2)In flight project reviews – Checkpoint reviews to make sure projects are running on time, on budget and issues and changes have been documented. This review, in particular, can make sure that controls are not shortchanged if time and budget gets squeezed due to other problems.

3)Pre-go-live controls review – Make sure everything that needs to get done has been done before go-live.

4)Post-implementation controls reviews – Make sure, in more detail, that what needed to get done before go live was done, and any remaining tasks are on a list and prioritized for next phases. In addition, any issues or problems are also on a list and there is an appropriate plan and process to continue to resolve them, even after the integrator goes home.

5)Runaway project reviews – Assessing where a project has gone off course, documenting gaps in expected results and actual results, and establishing the revised project plan, prioritized, to get gaps filled, in particular with regard to controls

McKenna Partners is able and willing to assist in any or all of these types of projects, in particular if they have a cross-border impact (Hello Levis!).

Advertisement over.

As usual, you seem to hit the nail right on the head. The quality IT “auditors” have so much more to offer than just audit assistance. They can offer implementation assistance, and other process improvement help, as you mentioned in your article. What blows me away, again as you mentioned, are the IT Audit partners who seem to totally miss these opportunities. I think the problem is that they are so intertwined into the “audit” mentality, that they either don’t understand, or don’t know how to sell, “consulting” services. I understand that both EY and KPMG are attempting to build “advisory” practices catering to CIO needs, however both are still very early on in their developments. As for Deloitte and PWC, I guess time will tell what happens to their IT Auditors…