Specialists don't care about your checklists

The SEC just stood up a specialized unit to hunt accounting fraud. For most of you, this is a footnote in a weekly briefing. For anyone actually responsible for the numbers, it's the only thing that matters this week.

Here is why: Most firms treat SOX as a compliance exercise, a series of boxes to tick so the external auditors don't scream. They build "control theatre," where the evidence exists but the actual risk remains wide open. A specialized unit doesn't look for the existence of a policy; they look for the gap between the policy and the reality. They aren't checking if you have a sign-off process; they're looking for who signed off on something they didn't read.

The common defense is that external auditors already provide this layer of protection. That's a fantasy. Auditors check if a control is operating as designed. A fraud specialist asks if the design itself is a lie.

If your controls are just a layer of paint over a crumbling wall, the cost at year-end isn't a deficiency finding. It's a federal investigation.

The second-order effect here hits the audit firms. When a regulator creates a dedicated unit to find what auditors missed, those auditors suddenly become the next target. We've seen this movie before. The SEC doesn't just want the fraudster; they want the people who swore the controls were working while the money was walking out the door.

Then we have the opposite end of the spectrum: pure theatre.

BNB Chain spent some money to get ISO 27001 and 27701 certifications. I've seen a thousand ISO certificates in my career. They are lovely pieces of paper for the marketing slide deck, but they don't stop a breach. A certification tells me you had a consultant tell you how to write a manual. It doesn't tell me if your actual environment is secure.

Contrast that with a practice management firm that just notified nearly 4 million people about a data breach. That's the price of relying on third-party certifications instead of actually testing the vendor. If you aren't auditing your vendors' actual controls, you aren't managing risk; you're just outsourcing your failure.

The cost of these failures is scaling in ways that should make every CISO sweat. Look at Toronto, where a surgeon was hit with a $22.5 million privacy fine.

That isn't a slap on the wrist. It's an existential event.

It puts the Canada Revenue Agency's breach into perspective, where some Canadians are eligible for just under $5,000 in compensation. One is a systemic failure managed by a government treasury; the other is a targeted hammer coming down on a professional who thought they were too small to be a target.

You can hide behind a certification or a "standard operating procedure" for a while. But specialists are now being paid specifically to ignore those documents and find the truth.

I wonder how many of your "effective" controls would survive an afternoon with someone whose only job is to break them.