Manchester United saw their stock rise at the early part of the year. Up till February 2019, the team was racking up victory after victory and in the process ended with 11 victories on the road, their best run in the history of the club. The club didn’t need a soothsayer to tell them to change the manager’s status from interim to full time. Fast forward to March 2019 and till this moment, they have lost 7 of their last 9 games and most likely a 10th tomorrow.

Something is definitely wrong somewhere and it could be that every of their opponents have discovered the weakness and inherent risks associated with Manchester United. From Governance to organization structure, to managers and employees. The club is in a deplorable state. It is no longer business as usual; competitors are changing business models to outperform each other.  The footballers currently pose the biggest threat. Their last outing against Everton was pathetic. They were defeated in every position. The response of the Management was to tell supporters to expect a massive exodus of players from the club. They believe the current skills of their players are not in tune with the current roles. At the moment, this is what their indicators are revealing.

 What is your indicator revealing? You have always conducted precise audits and generated excellent reports. But the issues persist. Management has a better idea and stakeholders just don’t buy your recommendations.

Wait! A wave is coming. This time, you will have to go the extra mile to get the job done.

Dear auditor, business models are changing, are you ready?

 Earlier in the year, my company was privileged to be invited to audit an information system used by a microfinance bank. As a team, we had assembled to dish out roles and examine various tasks as usual. On the team were financial auditors, information systems auditors, network administrators, database specialists, server administrators, security managers and a web developer. It seemed like we had the best team around. Off we proceeded to the client’s office. On arrival, we were handed the terms of reference and the usual functions appeared. Tasks range from duplicate check, edit check, reasonableness check, controls assessment, data validity, organizational structure audit, audit trail tamper proof, incident and review logs, bla bla bla.

What caught my attention was the application programming interface (API) audit and application source code audit. The task was to review the whole application for backdoors, code integrity, programming standard and API. Calculating the hash function would have showed if files have been tampered with but because there was no initial hash function of files stored somewhere, the comparison would be baseless. Secondly, verifying all the lines of codes to determine poorly written codes was the big deal and ensuring that the application was built according to best practices.

 I asked thre (3) developers if there exists a global standard for auditing/developing application codes. Their responses were negative.