0

I have seen many job descriptions for project managers in which organizations want the candidate should have been worked on different audits and audit reporting. I have 2 questions:

  1. Kindly explain what kind of audits we have in service based IT industry?
  2. As a project manager how I will support auditing?

closed as too broad by Todd A. Jacobs, Barnaby Golden, Danny Schoemann, Iain9688, Aziz Shaikh Sep 25 '16 at 7:55

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • This question is likely to be closed as "too broad." Please narrow your question. – Todd A. Jacobs Sep 8 '16 at 16:09
  • Maybe narrowing the question to a specific market (IT, Finance, Engineer) could give some hints on what kind of Audits these opportunities are talking about. – Tiago Cardoso Sep 8 '16 at 22:30
  • Audits are a compliance issue. What standards/regulations are you trying to comply with? – Todd A. Jacobs Sep 12 '16 at 22:06
1

The type of audit is going to vary widely - audits in Germany are going to be different from audits in USA. Audits in the public sector will differ from private sector. In general you're going to experience audits for any certificates you have (ISO, PKI, CMMI, etc.), for any government regulations (OMB, FIPS), and you're going to have periodic audits for computer security (multiple audits/year), budget, risk, physical inventory, software inventory, etc. Plus the inspector general wants to feel needed, so they will audit someone every year. If you include data calls (which are a type of audit), then we're audited about sixty times a year.

As a PM, how do you support the audit? Depends on the audit. Once a year they come through to audit all physical inventory that costs more than a threshold. We don't need to support that much at all. On the other hand when the security team comes through there is a week of collecting documents, a week of face to face interviews & demonstrations, and a week of writing plans of action & milestones. If the CMMI team comes through, we take a team of people offline for between one and six months to write documentation/artifacts, and the entire management team is on call for the duration of the audit. Plus all the post audit action.

(hat tip to @Laconic Droid) - Internal audits vs external audits will require significantly different preparation. On the other hand, I'd be suspicious of any job that requires experience preparing for internal audits. If such a job were advertised, I'd ask some pointed questions about what skills/knowledge/abilities they were seeking. Internal audits differ vastly from office to office, and I'm not sure how much skill transference is possible.

  • 1
    Another difference is internal vs external audits which typically have different goals and follow different processes. – Laconic Droid Sep 9 '16 at 17:48
1

There are different kinds of audits, which vary by industry - and those are just the external audits.

In the Army we had a CIP audit which was decently detailed - it handled site security, INFOSEC, adherence to IA directives and policies as well as cryptographic material storage and classification audits for spillage and aggregation. I was an acting project manager (not official rank/title at the time) and had to take time showing the investigators all of our facilities, handing over project documentation that was sent via email or stored in plain text to screen for classified material, etc.

In the private sector it varies differently like I mentioned by industry - one of the contracting firms I worked for was CMMI lv 3, and that was a huge pain, especially if people from your team or yourself got pulled off - I won't reiterate what the @Mark already mentioned.

You also have internal policies and processes from the IT Gov/PMO which may or may not outline internal audits. For my particular company our Audits involve quarterly review of 15% of projects that are currently active - if your project gets pulled you will have to submit all of your status reports, IDPs, CRs, KPIs, and anything else your organization happens to use. My company gets a little zealous and will pull audio from recorded meetings to ensure everyone is following the SDF (Solution Delivery Framework) as designed, so as a PM not only do I get audited, I help audit others through our "peer reviews" bi-yearly.

A lot of it depends on the industry and company you are in, but those are some examples as a PM you will have to assist or get dragged into one.

Not the answer you're looking for? Browse other questions tagged or ask your own question.