For Immediate Release: Shape Minds, Build Brands, and Deliver Results with Game-Changing Public Relations (2015)

---

When I finally find the conference room for the 8 a.m. meeting, I immediately notice how silent it is, devoid of the usual small talk that fills the time while attendees trickle in.

Nancy sits at the head of the table, with four other people sitting around her. Sitting next to her is John along with his ever-present, black three-ring binder. As always, I’m surprised by how young he is. He’s probably in his mid-thirties with thick, curly black hair.

John has a haggard look about him, and like many college students, has continually gained weight in the three years he’s been here at Parts Unlimited. Most likely from all the stress associated with his failing moral crusade.

John actually reminds me more of Brent than anyone else in the room. However, unlike Brent who normally wears a Linux T-shirt, John wears a starched, collared shirt that’s slightly too large.

Wes is conspicuously underdressed compared to everyone in the room, but he obviously doesn’t care. The last person in the room is a young man who I don’t recognize, presumably the IT auditor.

Nancy begins, “We have just concluded our Q3 internal audit in preparation for the upcoming external SOX-404 audits. We have a grave situation. Tim, our IT auditor, found an eye-opening number of IT control issues. Worse, many are repeat findings going into the third year. Left unresolved, these findings may force us to conclude that the company no longer has sufficient controls to assert the accuracy of its financial statements. This could result in an adverse footnote from the external auditors in the company 10-K filings with the US Securities and Exchange Commission.

“Although these are only preliminary findings, due to the gravity of the situation, I have already verbally informed the audit committee.”

I blanch. Although I don’t understand all the audit jargon, I know enough that this could ruin Dick’s day and mean potentially more bad front-page news.

Satisfied that I understand the severity of the situation, Nancy nods. “Tim, please walk us through your conclusions.”

He takes out a huge stack of stapled papers, handing one out to everyone assembled. “We have just concluded our audit of the IT general controls at Parts Unlimited for all of the critical financial systems. It took a team of four people over eight weeks to create this consolidated report.”

Holy crap. I lift the two-inch thick stack of papers in my hand. Where did they find a stapler this big?

It’s a printed Excel spreadsheet, with twenty rows per page in tiny eight-point type. The last page is numbered page 189. “There must be a thousand issues here!” I say in disbelief.

“Unfortunately, yes,” he responds, not entirely able to hide his smug satisfaction. “We found 952 IT general control deficiencies, of which sixteen are significant deficiencies and two are potential material weaknesses. Obviously, we’re very alarmed. Given how soon the external audit starts, we need your remediation plan as soon as possible.”

Wes is hunched over the table, one hand on his forehead, the other hand flipping through page after page. “What kind of horseshit is this?”

He holds up one page. “ ‘Issue 127. Insecure Windows operating system MAX_SYN_COOKIE setting’? Is this a joke? In case you haven’t heard, we’ve got a real business to run. Sorry if that interferes with this full-time audit employment racket you’ve got going on here.”

Trust Wes to say what people are thinking but are too smart to actually say aloud.

Nancy responds gravely, “Unfortunately, at this point, the phase of control review and testing is over. What we require from you now is the ‘management response letter.’ You need to investigate each of these findings, confirm them, and then create a remediation plan. We’ll review it and then present to the audit committee and the board of directors.

“Normally, you would have months to prepare your response letter and execute your remediation plan,” she continues, suddenly looking apologetic. “Unfortunately, the way the audit testing calendar worked out, we only have three weeks until the external auditors arrive. That’s regrettable. We’ll make sure to give IT more time in the next audit cycle. But this time around, we require your response by…”

She looks at her calendar. “One week from Monday, at the very latest. Do you think you can make it?”

Oh, shit.

That’s just six working days away. We’ll need half that time just to read the entire document.

Our auditors, who I’ve long believed are a force for justice and objectivity, are crapping on me, too?

I pick up the huge stack of papers again and look at a couple of random pages. There are many entries like Wes read, but others have references to inadequate security settings, presence of ghost login accounts, change control issues, and segregation of duties issues.

John flips his three-ring binder open and says officiously, “Bill, I brought up many of the same issues with Wes and your predecessor. They convinced the CIO to sign a management waiver, stating that he accepted the risk, and do nothing. Given that some of these are now repeat audit findings, I don’t think we’ll be able to talk our way out of it this time.”

He turns to Nancy. “During the previous management regime, IT controls clearly weren’t a priority, but now that all the security chickens are coming home to roost, I’m sure Bill will be more prudent.”

Wes looks at John with contempt. I can’t believe John is grandstanding in front of the auditors. It’s times like this that make me wonder whose side he’s really on.

Oblivious to Wes and me, John says to Nancy, “My department has been remediating some other controls, which I think we should be given credit for. For starters, we’ve completed the tokenization of the PII on our critical financial systems, so at least we dodged that bullet. That finding is now closed.”

Nancy says dryly, “Interesting. The presence of PII is not in the scope of the SOX-404 audit, so from that perspective, focusing on the IT general controls might have been a better use of time.”

Wait. John’s urgent tokenization change was for nothing?

If that’s true, John and I need to talk. Later.

I say slowly, “Nancy, I genuinely don’t know what we can get to you by Friday. We’re buried in recovery work and are scrambling to support the upcoming Phoenix rollout. Which of these findings are the most important for us to respond to?”

Nancy nods to Tim, who says, “Certainly. The first issue is the potential material weakness, which is outlined on page seven. This finding states that an unauthorized or untested change to an application supporting financial reporting could have been put into production. This could potentially result in an undetected material error, due to fraud or otherwise. Management does not have any control that would prevent or detect such a change.

“Furthermore, your group was also unable to produce any change management meeting minutes, which is supposed to meet weekly, according to your policy.”

I try not wince visibly, recalling that no one even showed up at the CAB meeting yesterday, and during the payroll incident, we were so oblivious to John’s tokenization change that we ended up bricking the SAN.

If we were clueless about those changes, I sincerely doubt that we’ d notice if someone disabled a control that would enable a minor, say, $100 million fraudulent transaction.

“Really? That’s unbelievable! I’ll look into that.” I say with what I hope is the right amount of surprise and moral outrage. After I pretend to take detailed notes on my clipboard, circling and underlining random words, I nod, prompting Tim to continue.

“Next, we found numerous instances where developers have administrative access to production applications and databases. This violates the required segregation of duty required to prevent risk for fraud.”

I look over to John. “Really? You don’t say. Developers making changes to an application without an approved change order? That certainly sounds like a security risk. What would happen if someone coerced a developer, say Max, into doing something unauthorized? We’ve go to do something about that, right, John?”

John turns bright red, but says politely, “Yes, of course. I agree and would be happy to help.”

Tim says, “Good. Let’s move onto the sixteen significant deficiencies.”

A half hour later, Tim is still droning on. I stare glumly at the huge stack of findings. Most of these issues are just like the huge, useless reports we get from Information Security, which is another reason why John has such a bad reputation.

It’s the never-ending hamster wheel of pain: Information Security fills up people’s inboxes with never-ending lists of critical security remediation work, quarter after quarter.

When Tim finally finishes, John volunteers, “We must get these vulnerable systems patched. My team has a lot of experience patching systems, if you require assistance. These audit findings are an awesome opportunity to close some big security holes.”

“Look, both of you guys have no idea what you’re asking for!” Wes says to John and Tim, clearly exasperated. “Some of the servers that those manufacturing ERP systems run on are over twenty years old. Half the company will grind to a halt if they go down, and the vendor went out of business decades ago! These things are so fragile that if you even look at them at the wrong time of day, they’ll crash and require all sorts of voodoo to get them to successfully reboot. They’ll never survive the changes you’re proposing!”

He leans over the table, putting his finger in John’s face. “You want to patch it yourself, fine. But I want a signed piece of paper from you saying that if you push the button and the entire business grinds to a halt, you’ll fly around and grovel to all the plant managers, explaining to them why they didn’t hit their production targets. Deal?”

My eyes widen with amazement when John actually leans forward into Wes’ finger and says angrily, “Oh, yeah? How about when we’re on the front page of the news because we lost consumer data that we’re responsible for protecting? You’ll personally apologize to the thousands or millions of families whose data are now being sold by the Russian Mafia?”

I say, “Settle down, everyone. We all want to do what’s right for the company. The trick is figuring out what we have time to do and what systems can actually be patched.”

I look at the stack of papers. Wes, Patty, and I can assign people the task of investigating each issue, but who will actually do the work? We’re already buried with Phoenix, and I fear that this new massive project might be the straw that breaks the camel’s back.

I say to Nancy, “I’ll get with my team right away, and we’ll come up with a plan. I can’t promise you that we’ll have our response letter completed by then, but I can promise you that we’ll get you everything we can. Will that be adequate?”

“Quite so,” Nancy says amicably. “Going through the preliminary audit findings and identifying next steps were the only objectives for this meeting.”

As the meeting adjourns, I ask Wes to stay behind.

Noticing this, John remains behind, as well. “This is a disaster. All my objectives and bonuses are tied to getting a clean compliance report for the SOX-404 and PCI audits. I’m going to fail because you Ops guys can’t get your shit together!”

“Join the club,” I say.

To get him off my back, I say, “Sarah and Steve decided to move up the Phoenix deployment date to next Friday. They want to skip all the security reviews. You probably should talk to Chris and Sarah right away.”

Predictably, John swears and storms out, slamming the door behind him.