Compliance Farm™: Theory of Professional Practice Evolution (Non-linear)

Potato

• Interprets all knowledge as explained by prime time television

Fish

• Eats bait
• Captured for sport
• Required in food chain

Sheep

• Lives in a heard
• Keeps head down via lifelong commitment to grazing
• Fears Dogs
• Greatest accomplishment – Is not a Potato

Self Aware Sheep

• Realizes there’s more to life than being a Sheep, but can’t put hooves on what to do about it

Snake, Rats and Pigs

• Not useful to this discussion, but snakes and pigs are out there

Shark

• See Snakes, Rats and Pigs

Dog

• Loyal to one or more professional cause
• Enthusiastic bark
• Limited bite, growls via e-mail, i.e., flaming for fame
• Wildly sniffs while investigating new smell
• Quickly loses interest in familiar stink

Dog-Squirrel

• Keeps a copy of everything
• Buries files in back yard
• Prepares to read in winter

Dog-Fish

• Resolves all problems by being a Fish, otherwise Dog

Rescue Dog

• Registered to Vote
• Board member in one or more professional chapters
• Known to rescue the cold and stranded
• Reads journals and at least one newspaper
• To a large extent, views hard work as its own reward
• Looks up to Wolf
• Known to generate legal smudge, causing others to mistake Dog for Donkey
• Loves brandy
• Sleeps anywhere warm

Wolf

• Mates for life
• Keen sense of direction and survival, develops tools to serve the Wolf’s purpose
• Travels in a pack, yet stands alone
• Hunts for its own food, sometimes penetrating thick walls of ice
• Tremendous ingenuity
• Known to eat Dogs and Sheep who “flame for fame”
• Not concerned by other packs unless fighting over territory
• Votes per instruction of Leader, enlisting Rescue-Dog to heard sheep to polls (sheep never register to vote)

Leader of the Pack

• Picks the party candidate, and directs every Wolf to get out there and vote
• Uses instinct to advance the pack, marketing products and ideas for both profit and real utility. (Not a Shark)
• Takes risks and fights for territory, able to sell the tools made by the pack
• Exceptional instinct is used to assure everyone’s survival
• Uses public image for being ruthless, to hide evidence of self sacrifice and compromise for a greater good
• Long cleared on charges regarding Little Red

Eagle

• Soars above the fight, preferring observations of trend over facts
• Leverage simultaneous centers of focus, seeing both forward and peripherally
• Critical to the balance of vermin, spotting rats at altitudes of a 1000 feet
• Eagles are the only species in possession of the big picture
• They see what others can’t imagine, and most refuse to believe
• Eagles accurately pinpoint by longitude and latitude, every national fault

Human Being (Human)

• Marked by goals involving world value achieved through arts and sciences, Surpasses Wolf in vigilance, to create new standards for both ethics and practice
• Faces actual threats, by leveraging Eagle’s data to prioritize faults, and Wolf’s ingenuity for tools, survival instinct and good sense in designing a practical response strategy
• Humans can be found in think tanks, governments, clergy, universities, private industry and even the world of entertainment
• They commit with or without promise of glory, are more often sentenced to death than awarded a Nobel Prize
• Humans admit to having been Fish, Dog, Wolf and Sheep, because they have humility
• Regardless of whether we agree with a Human’s goal, chances are we would not last a day in their shoes

Under the right set of circumstance every animal has the potential to be both Eagle and Human[16]

Cartoon plan:

Why Can’t The Government Fix It?

Two women in hiking gear, far off mountain peak creates enormous shadow-

Woman with binoculars asking: “Has NASA found a reason for the region’s sudden lack of sunlight?”

Woman two answers: “They know the cause.  It’s Mount Must Read™, increasing at a rate of 2.4 kilometers a day.  No one knows how to stop it.”

What should an Information Systems Auditor eat?

Back to the quest: There had to be a faster approach to the overlapping mandates question, like one single standards/frameworks and laws inventory.  Starting points included sources I use regularly, acclaimed web sites like K-NET[17], Security Benchmark[18], CERT/CC®[19], IIA[20], and the ISACA Member Downloads[21].  If you spend a portion of every day at these sites you will never be disappointed.  On this particular day, I landed a substantial jewel, the newly released Aligning COBIT®. ITIL® and ISO 17799 for Business Benefit[22].  Nothing speaks louder to the cause of harmony among standards than the highly planned marriage of giants; ISO/IEC 17799:2005 (developed by ISO[23] and the IEC[24]), COBIT®. 3rd Edition[25] (under ISACA copyright[26]), and ITIL® (the flagship standard and product, produced by the United Kingdom’s Office of Government and Commerce[27]).  Barriers to effectively combine assessment frameworks are dismantled as each body revises their newest release, adapting wherever possible vocabulary and control concepts.  The organizations worked together, leveraging the best each offers to business, supplying one definitive meaning; a single unified model which is useful to any person engaged IT Governance.

I felt a new confidence, (counted the pills again), and looked right into Must Read's™ eyes asking: “You still here?  Take a hike!  Beat it, scram.  You’ve seen the list on K-Net.  I don’t need you.”

This wasn’t even dignified by a response.  Must Read™ smirked, the kind that mothers and high school teachers use to say “You can’t be serious,”  which would have been bad enough, but then Mount Must Read’s™ reign of terror truly came down.

“Where do you get the a-u-d-a-c-i-t-y to claim competence using the exclusive direction of Everett C. Johnson[28] (ITGI's International President), Tom Lamm[29] (ISACA's Director of Research, Standards, and Academics), and a handful among thousands of standards from ISO?  Can you even spell G-A-A-P?[30]  It’s the perfect word to describe the span of your pathetic attempts at thinking.  Can you tell me one thing about David Richards[31] (President of IIA)?”

This is when he threw the killer blow, tossing the Global Technology Audit Guide (GTAG[32]), Information Technology Controls[33] right in my face.

Did I mention that it’s sundown on Halloween and I’m trapped by a psychotic reading stack? I live on a quiet street.  No one will care if I scream.

Cliff Notes[34] were too risky.  I might miss a critical detail, never having time to get off a second shot.

This would end in a single bullet.  I picked up the Global Technology Audit Guide (GTAG) and without stopping, read every word to the last reference and copyright on the report cover’s back page.

In addition to appeasing Must Read™, the learning experience was tremendous.  Like great documents produced by ITGI and contributors to ISACA, this IIA’s Technology Audit Guide provided a comprehensive overview in approach and standards for IT Control Audit, including COBIT® as a primary and foundation IT Control standard.  The journey, however, went beyond familiar ground, displaying a scrumptious menu of dishes I did not even know an IT Auditor was allowed to eat.

Reviewing the resources and contributor background shows IIA's coordinated efforts with the AICPA[35], CIS – Center for Internet Security[36], CMU/SEI (Carnegie-Mellon University - Software Engineering Institute)[37], ISSA (Information Systems Security Association)[38], NACD (National Association of Corporate Directors)[39], and SANS Institute[40].  Just getting a group this size to agree to one paragraph is notable, but this document amounted to agreement on the entire IT Control Map.  I’m sure I’ll continue my heavy us of COBIT® Online[41] as a fundament tool for my practice, but the list of additional resources found in the GTAG held a great deal of promise.

Triumphant: “I shaved 7/10 cm off your peak without downloading Cliff Notes, summary, or random surfing.  Bet you weren’t expecting that?”

Mount Must Read™ is still laughing.  “Did you catch those footnotes, hyperlinks, appendixes, and references?  You’ll be downloading all night!” He was right.  They were new titles.