Advisory Note: Working to the Business not the Auditors - 70865

There can be many reasons to why a business embarks on a journey to improve its Information Security. There is however one reason which consistently recurs: “Because the auditors says that we need to…”

Regulatory requirements include penalties for non-compliance but this often creates a tick-box approach to compliance, rather than a considered, strategic view. Where the bare minimum of cost and effort can be made to avoid a fine, this is often seen as the most beneficial approach for the business. Clearly we need to listen to the auditors, but we neither should let the auditors take over the business transformation and change strategy, nor only rely on auditor requests for moving forward in Information Security. The Auditors should be one of many influencers to our strategy for transformation...