Aren’t IT auditors meant to stop (IT) frauds?
NO! At least not directly, unless the frauds are perpetrated within the IT audit function anyway. Audit independence means that auditors do not form part of the routine system of controls in operational areas of an organization – that dubious honour usually belongs to “management” or, more broadly, “someone else”. Managers and staff are responsible for designing, implementing, operating and maintaining the appropriate system of controls to prevent fraud or other control failures (e.g. accidental loss of key data, or even the keys to the fire safe). Auditors are responsible for examining and commenting on those controls but again it is management’s duty to respond appropriately to audit reports and recommendations. You might say that auditors are irresponsible.
