Undercover

Audit Agitation

What do you do when your customers want you to do an independent security auditand your CEO doesn't?

February 01, 2005 — CSO — My CEO is a psychopath. No, really he is. He's a lying, manipulating, amoral, selfish, screaming-like-a-madman, intellectually challenged, dysfunctional excuse for a human being. And those are his good qualities. But, surprisingly, I read recently that I am not alone in enjoying such a CEO. It's actually quite common for psychopaths to become CEOs. So much so that a company in the United Kingdom now specializes in employee testing to try to identify and hopefully retrain those exhibiting psychopathic tendencies before it's too late, and they are taking the express train to the top of the corporate ladder. Too bad this company didn't exist while my piece of work was in his formative corporate years.

I tell you all this not for sympathy, but so that you can imagine my discomfort when I had to approach my CEO and explain what a SAS 70 was and why we needed it.

For those who don't know, a SAS 70, or Statement on Auditing Standards No. 70, is an internationally recognized standard developed by the American Institute of Certified Public Accountants. A SAS 70 audit represents that an IT services provider (for example, a financial services organization) has been through an in-depth audit of its control activities, which generally include information technology, security and related processes. The Sarbanes-Oxley Act of 2002 makes SAS 70 audits even more important to the process of reporting on effective internal controls at IT services organizations. That's because the reports signify that a service organization has had its control objectives and control activities examined by an independent accounting and auditing firm, as Section 404 of Sarbanes-Oxley requires.

And I had to explain all this to a man who has the patience and temper of a 2-year-old with a diaper rash. Right.It Wasn't Exactly a Tea PartyI approached the CEO's office with a queasy feeling of resignation and trepidation.

"Mr. Blowhard is running late," his attractive, blond administrative assistant informed me. "He's very busy these days, you know," she continued, with a slightly irritated frown.

Great, I thought, I can enjoy my misery stew a little while longer. I sat in an overstuffed leather chair in the waiting area outside his office. Inside, I could hear Blowhard screaming at his latest victim, his voice rising steadily in a paroxysm of hysteria. Suddenly the door banged open and out the CEO sprang. His bald head sported beads of sweat.

He thrust out his arm, directing the way out. "And don't f***ing come back here until you get it right!" he shouted. His unfortunate victim slithered past him.