The best defense is a make-believe offense

Been there, done that, lots of bull on both sides.

Ahh, Digital Willie, you have nailed the distinctions in Audit Types.
Before I retired, I had worked for a regional accounting firm. Besides doing management consulting in IT, I also got involved with Auditing, handling the IT audit end of Financial Audits. We also did work with companies to help them with Compliance type audits for ISO and other types of compliance audits.
One of the small pleasures that I often got was when a hot-shot from the client would try to buffalo my team on IT issues. Since I've been in the industry a long time, with a forward looking company, when it came to a "certification showdown", more than half the time it seemed that I had more certifications than the hotshot.
Of course, in the Management Consulting engagements, often as not, the IT folks would have more on the ball than the Accounting folks. So much fun when you could put the Accounting guys in their place with the simple idea that "Have you checked with your IT Department?" "You *do* know that they have tools to go with the XYZ package to give your what you want without paying more staff or other resources. You already own it....."
IT-CPA plus a whole lot of other certs.

Auditors vs. Bean Counters

Many of the comments made so far this morning have good content. BUT, I think that there are some subtleties that have been obscured by all of this thrashing over Auditors.

Compliance Audit - when the Govt. Goons come in and want to make sure you aren't scamming an unsuspecting public. These are often no nothings as described. However, I will say that I have met a few bright lights when I was teaching IS Audit to people like the FDIC and Treasury. Trouble is those square pegs are soon sanded smooth into a round hole, if you get my drift.

Certification Audit ALA ISO - a review to prove you are doing what you say you are doing about what you are doing..... Not really designed to search out and promote positive changes.

External Audit - annual tooth extraction by your Financial audit firm. Often there are some decent IS types in these firms. Unfortunately, they are far overstretched and cannot hope to give the individual attention they should to every client.

Internal Audit - company people who come onto the battlefield after the war is lost, to bayonet the wounded! Just when you think that you have everything worked out, all your systems are ticking over, you have no glaring security holes, your audit trail for provisioning users or change management is clean; they come and shoot everything full of holes and tell you that you are not "industry compliant" or that you have no "best practices".

None of these are fun. But if the last group does its job properly, since they work for management, you should have less problems with the first two.

Having worked in Internal Audit, as well as being an external consultant to Audit and Security, I can say that Tone At The Top is what makes the difference.

If Management believes in making changes to bring the organization into compliance and best practice, Auditors serve a very usefull purpose. That is only if they are properly qualified and resourced to provide the degree of oversight that would find the areas of weakness that are always there in any system.

Don't hate them teach them. Make them part of your arsenal to push good governance and best practice. If you don't, it will always be like a visit to the dentist....WITHOUT Novacaine!

I'm confused. Is there

I'm confused. Is there someone who actually believes that all these audits do any real good?

Next thing you know someone will believe that all these tests they give in public schools are actually improving our schools.