Please note that this is a page from a previous version of Continuity Central and is no longer being updated.

To see the latest business continuity news, jobs and information click here.

Business continuity information

Pre-audit ‘clean-ups’ create risks

Osirium has released findings from a new, independent, security focused research report. The study was commissioned by Osirium to highlight IT practices with hidden and potentially serious consequences that would have a major impact on businesses.

The most significant and worrying finding, according to David Guyatt, CEO at Osirium, was that “over 70 percent of those surveyed admitted that system administrators often make uncontrolled IT changes immediately prior to audits in order to meet compliance, after which they then let these changes lapse. If the auditors knew this was the case, they would surely fail the audit in the first place.”

These findings appear to suggest that organizations are willing to accept the risks associated with making such informal and uncontrolled changes rather than dealing directly with the costs of repeating failed audits which would also impact on resources and performance & analysis reports presented to senior management.

The report also highlights that IT staff typically spend as much as 30 percent of their time preparing for, and delivering, audits while less than 20 percent of the organizations polled fully automate the gathering of data for such audits. Fewer than 10 percent of those questioned said that they automate the remediation of audit gaps.

About the research
The research was completed by QuoCirca in August 2011 and 100 interviews were collected. At the time of answering the questions, those surveyed were not aware that the research was being conducted on behalf of Osirium. Respondents were qualified in as follows:
– Must be involved in IT management with one of the following job functions: IT manager, IT security manager, IT infrastructure manager
– Must answer yes to: “are you involved with, or knowledgeable in how your organisation views and manages issues relating to privileged users (that is how the granting of the extra privileges that IT administrators require to do their jobs is controlled), the automation of IT admin tasks and how these issues relate to your organisation’s ability to meet the regulatory requirements that govern it?”


•Date: 29th September 2011 • Region: World •Type: Article • Topic: ICT continuity

Business Continuity Newsletter Sign up for Continuity Briefing, our weekly roundup of business continuity news. For news as it happens, subscribe to Continuity Central on Twitter.

How to advertise How to advertise on Continuity Central.

To submit news stories to Continuity Central, e-mail the editor.

Want an RSS newsfeed for your website? Click here