Ignore the auditors, but be wary of the fallout
Posted by Ed in Analysis on Jul 28, 2010
So, here’s an interesting thing. I was reading through the coverage going on today about BP turning off the warning system on the Deepwater Horizon and also the coverage about how the computer that provided remote telemetry data back to the station was always blue-screening so was usually unavialable.
It’s all interesting stuff. However, what really caught my eye was the New York Times coverage from last week. Check this out:
The rig’s history of mechanical errors was documented in a confidential audit conducted by BP seven months before the explosion… According to the September 2009 document, four BP officials discovered that Transocean, the rig’s owner, had left 390 repairs undone, including many that were “high priority,” and would require a total of more than 3,500 hours of labor…. The 60-page audit found that previously reported errors had been ignored by Transocean. “Consequently, a number of the recommendations that Transocean had indicated as closed out had either deteriorated again or not been suitably addressed in the first place,” investigators wrote.
So this looks really bad, right? It sounds like reprehensible behavior – after all, ignoring that audit like that? Knowing about all those issues and failing to take any action? But this isn’t unusual in the audit world. This is like the result of any audit ever: there’s always a laundry-list of high priority items that aren’t going to get addressed. Shoot, I’ve seen folks have “critical” issues open for half a decade and completely fail to take any action whatsoever… which is OK as long as nothing bad happens.
You see, once something bad happens, everybody and their brother wants to come and armchair quarterback the thing. And ignoring something that appears in red with the words “high priority” or “critical” next to it is the kind of thing that people latch on to and won’t let go of. In point of fact, if I were a lawyer (which I’m not) and I wanted something to support a claim of nonfeasance, this is something I’d cling to like a drowning man.
My point is that if you’re sitting on a “hot potato” – like maybe an audit that has numerous critical areas that need addressing, keep in mind that failure to act carries a pretty hefty set of dangers. Think about what could happen if the worst case went down tomorrow. It’s better to plan for the worst: document what you’re doing, respond to all of the items on the audit, and do something about them (for God’s sake, anything – even if it’s just writing a one-page management response that says you disagree with the finding) rather the get left holding the potato when the music stops.



Pingback: Tweets that mention Ignore the auditors, but be wary of the fallout | SecurityCurve -- Topsy.com