Does the punishment fit the crime?

If your favorite pastime is cooking books, or you happen to run an electronic smuggling operation over parallel circuits beneath the data center floor, you certainly have my permission to feel all sorts of fear, uncertainty and doubt.  IT controls and their associated tools detect a lot of good and bad practice.  Punishment, however, is for people who commit crime.  The Sarbanes-Oxley Act became landmark when accountability publicly enforced sentencing and jail time.  Control frameworks, however, existed long before the events of this decade’s most notorious financial crimes.  Jail time for the likes of Dennis Kozlowski (Tyco), Bernard Ebbers (World Com), John Rigas (Adelphia) and who knows, perhaps even Michael Brown (FEMA/ Katrina) is a punishment that fits.  Citing those eleven lessons again, ‘proportionality’ must always be applied.  Forcing a public company to spend more time on controls than in the path of their core business begs a lot of questions around fairness and legal intent.  The standards we apply as auditor should not have the look and feel of punishment.  Controls leverage technology to bring value to the business.  The goal of audit is certainly to assure practice and prevent fraud, but it is not about retribution, or personal fame, and it certainly does not bring a company more revenue.  Risk is only relative to a company’s capacity to stay in business.

Cartoon plan:

It is our Fault:

Eagle flying over Unites States contour map, sees thick arrows at two end of jagged line and a sign post that reads “Our fault”

Do you mind one last question?

If desperation is what it takes to produce, “Please sir, can I have some more?”

Great developers often say the occasional server crash, file corruption and waterlogged backup tape is resulted in their best work.  Re-writes are a chance to fix the details we wish we had known before we started.  Not much in our life allows us this luxury.   Rewrites are good.

T.S. Eliot has been cited a great deal since The Fog of War included Robert McNamara’s reciting of the poem:

“We shall not cease from exploration

And the end of all our exploring

Will be to arrive where we started

And know the place for the first time[155]."

Maybe this is an Eagle’s best lesson: Vision is never perfect until it looks forward, side to side, and backward, at our history.

Re-writing a standard improves its application and the community involved in its making.  The best reason for rewriting already great standards, such as ISO/IEC 17799:2005, ITIL®2 and COBIT® 4th edition, is expanded perspectives and distributed ownership.  Comparing different Risk and Security Management guidelines produced by valid authorities comprised of credible and experienced teams only revealed that each group, based in slightly different audience scope and requirement, contributed usable and outstanding content to our field.

Increasing the number of people in the world who feel personally involved in information control is a good thing.  To emerging groups, such as ITPI, Association for Business Process Management (ABPM) and a myriad of Local Interest Groups:  I humble to their enthusiasm and commitment.   Their leaders no doubt are wolf spirits, so I honor them with reminder of Rudyard Kippling’s Law For Wolves.

The Law for the Wolves

Now this is the law of the jungle, as old and as true as the sky,

And the wolf that shall keep it may prosper, but the wolf that shall break it must die.

As the creeper that girdles the tree trunk, the law runneth forward and back;

For the strength of the pack is the wolf, and the strength of the wolf is the pack.  […][156]

For every organization skating the thin ice between influence and violation of copyright, publishing standards based entirely from ISO/IEC 17799:2005, COBIT®, ITIL® or COSO, I’ll just say, “Hats off to you.”  I prefer to buy my standards, if for no other reason than the liability of data management mistakes, enabling fraudulent use of other people’s information, 100,000.00 per instance software license infringement fines, and things that go bump in the night[157].

ISO/IEC/ANSI, AICPA, ISACA, NIST CMU/CERT and the IIA provide all the raw ingredients for a diet balanced in current best practice across every area of information systems and infrastructure management.  Tom Lamm[158], Brian Selby, Dan Swanson, Ron Hale, Fred Cummins, Tim Howes, Jamey Bryce Clark, Charles Le Grand[159], Gene Kim, George Spafford Jr., Julia Allen, Bruce Winters, and Mike Hines have collectively written works I will read for the rest of my life, but at least I can be confident that the best work is the most recent.  That I can conquer right now.  These people have spent a lifetime sharing ideas, feeding their children, running business, coaching little league, publishing masterful works, answering our posts, getting married, divorced, married again…  Most amazing and true, they actually talk to me, a plain old part squirrel, part rescue Dog.

Our Leaders are not preoccupied with a need to insure all audit problems are solved by their own frameworks and theirs alone.  In fact, they are more likely to start any conversation with a list of what they don’t know, inviting all the energy of what Richard Feynman, (Nobel Prize Winner) describes as “the pleasure of finding things out[160]."  They will introduce future bills, write to members of the PCAOB, SEC and Congress, appear before committee, and forever be listed in the footnotes of regulations and standards, affecting everything from banking to the standard of density for fasteners and threads.

Leaders and Eagles do not pop up like mushrooms four hours after any new regulation is signed into law[161].  Their names mark a progression of community.  No doubt they began in a toddler organization, and some may have joined troops fairly advanced in the fight, but each beginning grew to professional leadership.  Maybe their secret power is being a master of change, appearing as a member of the GAISP standard committee, then appearing as contributors to ISACA or IIA publications, and emerging again in legal journals, and once more on the committee known as the CISWG, (Computer Information Security Working Group).

Today these foundation ideas continue in the BS 27000 series.  The recent BS ISO/IEC 17799 (BS 7799-1) and BS ISO/IEC 27001:2005 (BS 7799-2:2005) publications demonstrate lifetimes of commitment to concepts respected world wide.  Every major player in the standards game has at least one team working to remove duplications, with ISO 9000 (Quality Management), ISO 14001 (Environment), OHSAS 18001 (Occupational Health & Safety), and all forms of BS 7799 1 and 2 (aka the ISO/IEC 17799:2005 and related series) taking the lead[162].  There are substantial shifts in language from IT Service Management to a broader ICT Infrastructure Management in all areas that pertain to information systems.  The expanded use of ICT Infrastructure in place of ITIL® Service Management and Service Delivery concepts makes room for a broader and more comprehensive mapping between British Standards and other frameworks, such as the COBIT® 4th edition by ISACA, NIST Special Publication 53a, FISCAM Volume Two and the ISG Tool[163] produced by the Computer and Network Security Task Force, which was created by members of the CISWG[164].

Being a loyal Dog, I really can’t solve world hunger.  I put my family and company in various annual giving programs because there are no small parts, only small contributors.

After brief adjustment counseling, Mount Must Read™ has accepted that less is sometimes more.  He may not be tall, but he’s quality.  In all matters of “keep or throw” he will give up old white papers as long as they go to his better half and loving partner, Mount Recycle™.

It’s time for the end of down time and recovery.  I am restored and ready for work.  There’s just one last question:

Why didn’t I write any of that?

I doubt that any completely original ideas still exist.  I’m not expecting to have one. I doubt any one person is able to see all the regulations and standards in one big picture, but if that Eagle is out there, my bet is he or she is working in a well recognized team.  All I learned from this journey of reading is there is still so much more that I don’t know.

I would however, like to clear up one issue.  Here’s my final ruling:

“With regard to alleged problems caused by overlap and conflicts in laws and standards; it is the recommendation of this jury including Loyal Dog, Mount Recycle™ and Mount Must Read™, that due to lack of evidence supporting conflict or damages, the case of Overlap vs. too Much Information is now dismissed.”

It’s all good.  Make your own strategy, tackle the mountain and enjoy a nice long read.

I’ve started a small list of rules on the white board by my desk:

Rule number one: Never move data

• Focus on legitimate location by classification and information type.
• Use access control to limit change and use.
• Use registered sources of information where the responsibility lies on them to keep data and standards current.

Rule number two: ‘Only handle it once’

• Decouple normalized data from stored data by creating business rules for data lookup.
• Attend to emerging standards by W3C and OASIS to insure that the smallest amount of unique information is all that we store in any process.
• Invest in real time valid feeds for standards of measure and control, so the standards are managed by the subject matter experts and the business is configured to leverage those controls.

Rule number three: Common language equals common mission

• Insure that all persons have ready access and training in the name and scope of all management functional areas, processes and programs by title.
• Use the best sources for current normalized glossary in including NIST, OGC, ISACA, ANSI, NISO, WTO, W3C , OISWG.

Rule number four: Believe in the myth that someone has already solved this

• Even if a problem is yet to be solved, there are people out there who share your quest and who will only add to your vision and quality of solution. None of us is as smart as all of us.
• If people who share your interest don’t seem to exist, keep looking.
• Believe in the myth that YOU can solve the problem. Genius is exclusive to people with the tenacity to continuously fail until they succeed.

Rule number five: Process optimization is what makes a process real

• Being unique isn’t the only way to bring value. Even if concepts can’t be patented, showing the world how to be faster, safer and more efficient still holds great value. Admitting existing work deserves alignment to current concepts is the first step.  Every rewrite makes us stronger.  Allowing others to make our own works better shows humility and true maturity.

Rule number six: Don’t re-work the design of others and claim to own their ideas

• Use industry standard names to construct the names of all things. Giving credit to great frameworks and standards validates mature methodology and service quality.

Rule number seven: Accurately represent the problem

• Ensure the right stakeholders agree with what needs to be solved.
• Isolate the known from the unknown.
• Reuse repeatable frameworks and configuration, including common language, definition of programs and process.

Rule number eight: Only record the variance from the norm

• Once a part of the configuration is defined, use it to extend the attributes of any other item. Only record the unique variance.
• Comply with norms and standards by limiting acceptable variance.

Rule number nine: Don't serve green eggs

• Factor the reception of presentation as equal in importance to all other elements combined. People can't use what they don't know they have. Be sure the delivery looks and feels like a practice already common to the culture.  New tastes, textures and smells are never big hits at a pot luck supper.  They are less popular in IT.  They never work in business.

Rule number ten: Make it easier to get permission than forgiveness.  Then, show no mercy.

• Factor protection of intellectual capital in the design and creation of content, approval and process.
• The construction of configuration and information based in correct business logic and standards shouldn't feel like secret sauce or be too complicated to simply explain.
• Business rules make sense to the business.
• Data Validation makes sense to data entry.
• Without their visibility to the construction of an answer, we live at the mercy of people who were never able to accurately represent the problem.
• Strive to make “easier to beg forgiveness than get permission” thinking both mute and obsolete.

Conclusion:

Tell everyone “Who, what, where, when and why”, or as the army has long understood, “the commander’s intent.”  Focus on outcome, and be open to variation in the path that gets us there.  Intended outcome, the representation of the problem, is more important than the instruction for its solution.

An accurate problem is more powerful than the implementation details.  Frameworks and standards are about methodology.  They are not, in of themselves, the solution.  In fact, they aren’t even the problem.

When we add minds to a project, it tends to extend time to finish and often results in failure.  I think I know the reason why.   We spend too much time instructing and not enough time sharing commander’s intent.  We spend almost no time at all asking, “is this the right problem?”

This is why we can’t go through life as sheep.  Sheep can’t ask if we are solving the right problem.  They are not aware of the problem.  We can’t live life as dogs.   Dogs bark the instructions and bite those who appear to step out of line.  Loyal as they may be, they also lack capacity to ask if we are solving the right problem.   Wolves are great problem solvers, but they may not share the answer, and they certainly are not concerned with issues affecting packs beyond their kin.  Eagles see our landscape.  Most of us lack the courage to open our minds, hearts and eyes to even a small portion of what Eagle’s perceive.  We need our Humans, our leaders.  We need to hear the problem and believe in our ability to contribute.

How many times have we accurately and flawlessly solved the wrong problem?  We never know what other’s will bring to the solution, but one thing is sure, if any single approach was working, we would not need everyone else to solve the problem.  Share the problem, share the wisdom, and believe in the brilliance of others.

Appendix A: Database and Ontology

Database: This data repository houses a collection of resources for Information Auditors.  The list of “What I need to know” is validated by cross referencing bibliographies in significant works, peer review and lists supplied by accredited organizations.  Organizing, researching, de-duplicating and summarizing are a continuous process.  Most text is verbatim summary of how each work or organization represents itself, with small areas of summary reflecting a small amount of compiled consensus and review.  Resources using white papers to primarily sell product, as well as papers lacking accredited review teams are generally removed from the list.  While often very well written, the works lack backing from organizations authorized to approve and release such works. 

Note that sites such as IIA, ISACA, AICPA and BSA list and sell resources such as books, training, journals and standards.  Retail materials provide necessary revenue organization.  I have been careful to avoid using the list as an advertisement billboard.  As with any profession, audit guidelines, accredited standards and training materials are generally under copyright and require purchase.  Where an item is necessary to professional practice, the location listed for purchase is limited to sites operated by standards and accreditation bodies such as CASCO, ISO, IEC, ANSI, ISACA, IIA and AICPA.

Each reference includes links to additional source data, validated web references that avoid advertisement or marketing bias.  The format is created as a means to quickly capture related lists of important and relevant source data.  Each item was reviewed for the laws it enforced and aligned with, applicability and use as defined by the author or as commonly understood in the field. 

Considerations for database inclusion:

Who needs to know this?

Is it current?  The nature of print is instant obsolescence.

Is it mandated by law? Is it also mandated by other laws?

Is it mandated by any Government or Industry?

Is this a Sunset Law or has it been repealed?

If a standard, do other standards handle this in a better or simpler way?

Is it almost the same as something else, or it is the same content with varied codification, for example BSI code of ISO/IEC standard, or U.S.C.  as codified by law.

Is there a conformity assessment body associated to the standard?

Is there higher authority to address this policy, standard, framework or legislation?

Are there accredited free or low cost implementation tools, and government supported bodies maintaining the standard?

Who are the current experts?  Are they cited as reference?  Does this violate a copyright?

In short: Considering, Organization Charter, Authority, Conformity, Relevance to IT Audit, Manner of staying Current, Use of Advertising or Self Interest, Regulations, Laws, Standards, Directives, Frameworks, Certifications, Conformity Assessment Bodies, Significant Works, Sponsoring Committee and Authors and Reviewers, Supporting Data, Audience, Adoption and Repeal, Superseding standards or frameworks

And - Are the authors mostly dog, eagle or wolf?  Is the work endorsed by Humans?

[ERD and Class diagram]

Repository Organization:

[Table and data definition removed to protect copyright on work in development with OASIS, ISACA and IIA.  Materials as developed will be shared through all organizations and linked here.]

Snapshot Source Document Database establishing relationships and applicability of critical organizations, regulations, and standards products: