The current IT audit paradigm is like the wild west. There are multiple parties with various governance, security methods, and few shared or centralized systems. Layer in the conflicted “truth” resulting from the payment flows between audit stakeholders that only incentivize auditors to look the other way, making it difficult to achieve a trusted risk assessment.

While originally intended to identify and mitigate risk (findings), the reality is today’s trust everything methods hide them. The end result is the risk pool and audit stakeholder parties have had no choice but to trust everything.