Comment by HenryBemis | Hacker News Reader

Comment by HenryBemis | Hacker News Reader

..and THIS is why you need a strong, independent Internal Audit dept, with serious, educated, trained IT Auditors.

News like that make me very angry.

From the little I find to read, looks like it would take a 'basic' IT Auditor could in a few days figure out (and fail) basic ITGCs.

And it amazes me when I hear the term "DevOps" (cringe). But hey, I get it.. we need to make money, A LOT of money, and we need to make it FAST because of reasons (competition, greed, lack of talent, timing, etc.). Who has time and money to spend on Dev/Staging/Prod? Only stupid highly regulated environments need to be stupid enough to do this..

Going back to the story, THIS happens, people go to prison, people die. I have (in my IT Audit years) discovered/uncovered SO MANY tragic things.

And what scares me.. when I see YC 'offsprings' hiring and 99.9% of jobs are "stuff-building/money-making". Zero audit roles. And I am not angry because "damn - please hire me".. it's that how many of these places have an experience, IT savvy auditor? Not someone's cousin that is an accountant.. (no disrespect - it will take a CPA 10+ years to not be tricked).

And with that, I leave you with a friendly note on IT Auditors find and hire one with strong IT knowledge/background. They are worth their weight in Latinum!!

To be fair, neither of the two organisations responsible for Horizon over the period in question - Fujitsu Services, formerly ICL Pathway - in any way resemble your pastiche of "YC Offspring" startups.

Indeed, they were the exact opposite: huge multinationals with presumably gigantic legal, infosec and HR policy departments who could probably jump through the various compliance hurdles required by this procurement process in their sleep.

By comparison the startups you're complaining about usually take years to reach sufficient maturity to take part in large public sector procurement processes like this.

Clearly in this case maturity and scale were not a bulwark against incompetence, opacity and mendacity. Indeed the opposite - as I type this the Post Office's lawyers Herbert Smith Freehills are making mealy mouthed justifications for witholding reams of technical evidence from the public enquiry for months. It's disgusting, and as someone running a small business and endlessly having to justify our commitment to information security, data privacy and transparency I find the hypocrisy infuriating.

I cannot blame the contractors. I can only blame the Royal Mail/Post Office.

On the world of RACI, the client is always the A. I don't expect the guy who gets paid to be honest. I expect the payer to do their checks.

And stuff like that could have been picked up but an ITGC audit, Project Audit (reqs), SOX, any type of break/smoke test.. and so on..

Somebody dropped the ball - hard. This could have been prevented and/or detected and/or corrected.

Having served as Internal Audit for many many years, I get angry because I/someone in my line of work should have caught this.

Now.. WTF was the internal audit of Royal Mail/Post Office? Why isn't the CAE brought in for questioning and what was the scope of their audits?

Yes, definitely NOT YC company. But I don't see any YC companies hiring auditors, only engineers ;)

You definitely should blame the contractors.

It's become very clear as the public enquiry has progressed [1] that Fujitsu were:

- aware of several bugs - including ones they'd fully understood the cause and mechanics of - that would induce double-counting of transactions

- aware that criminal prosecutions were underway against users of the system in which just such double-counted transactions would clearly have had a material impact on the case and the evidence aduced

- failed to raise the above in a timely manner, either to the Post Office who had directly requested audit logs, to external auditors, or to the justice system itself

[1] https://www.theguardian.com/uk-news/2024/jan/17/post-office-...

Reply on news.ycombinator.com