SIDEBAR: Examination Time

Here are nine strategies for working with auditors before, during and after an accounting review

While this increased scrutiny takes up important staff time and represents a challenge to the CIO, it's also an opportunity. CIOs can use auditors' analyses to improve their processes, to assess and manage risks, and identify problem areas. Here are nine strategies for surviving the auditing process with the auditors working with you, not against you.

SURVIVAL STRATEGY 1. Know that the world has changed. No one believes IT is a superhero.

In the past, both the external auditors (the CPAs who check a company's books) and internal auditors (who work with management to ensure compliance with accounting standards) tended to view IT with awed respect. That's no longer true. At the same time, the pervasiveness of computing has made the CIO a key person in nearly every auditing situation.

SURVIVAL STRATEGY 2. Make auditors part of the management team. Consider them friends.

CIOs should never treat the auditors as adversaries. It's important for IT managers to take a proactive approach to working with auditors, getting them appropriately involved even in the design stage of new systems. This proactive approach greatly lessens the likelihood of audit difficulties.

SURVIVAL STRATEGY 3. Communicate. Provide auditors with a full understanding of the IT department and its responsibilities.

Cooperating with auditors means communicating - a lot. The most important things that a CIO can do in working with internal and external auditors is be involved, to be supportive, and to be open and honest in all situations. Cooperation is a must if a CIO wants to avoid unpleasant surprises during an audit.

SURVIVAL STRATEGY 4. Seek auditors' help in evaluating business risks.

Collaboration with auditor colleagues improves the quality of IT applications by addressing policies, such as records retention, security and disaster recovery, early in the development process.

SURVIVAL STRATEGY 5. Let the auditors in. Give them access to strategic plans, documentation, security logs and test results.

It's not unusual for IT groups to lack the information that auditors need to evaluate them. CIOs are sometimes guilty of not taking issues such as security seriously enough. Instead, CIOs need to use the auditors to help create greater awareness of security issues. CIOs shouldn't be afraid to use the authority of the auditors to force security issues. In other words, if you need to play the good cop, let the auditors play the bad cop.

SURVIVAL STRATEGY 6. Alert auditors to new IT implementations. Get projects on the books accurately.

Keeping the auditors in the loop for new development projects helps ensure smooth audits because auditors can provide advice on security and reliability early in the game, making it easier to include appropriate controls and procedures.

SURVIVAL STRATEGY 7. Get auditors to help you understand when to cache it and when to trash it.

Auditors are excellent resources for CIOs who need to build policies for handling information within their companies. For example, most companies have a policy where they keep backup data for a certain amount of time. Getting the auditors involved in information policies helps IT groups include those policies as part of the application development process - rather than having to return to a system later to insert rules about what to keep and what to delete.

SURVIVAL STRATEGY 8. Make the auditing process part of the IT routine.

The ultimate responsibility for ensuring that IT groups pass audits lies with the CIO and IT managers. Good accounting controls and practices must be built into the day-to-day activities of the IT department.

SURVIVAL STRATEGY 9. Respond quickly to correct audit findings.

It's inevitable that even the best IT groups will get "dinged" in an audit. That's why it's important for the CIO to remain highly visible to both the audit committee and the top management of the company. A CIO should always feel comfortable going directly to the CEO or the CFO concerning anything that might be covered in an audit. It's better to face problems head on knowing what auditors have seen, what they are examining - and maybe even having led them to some examination targets.