Home > Management and Careers > Careers

Computerworld -

Vince Campitelli
Title: Managing director, enterprise technology audit
Company: Wachovia Corp., Charlotte, N.C.
What he does: Leads a 60-person audit team focused on identifying and managing risks associated with the use of IT at the $2.4 billion bank, the fourth-largest in the country. In banking and financial services, 70% to 80% of all risk is technology-related, because IT is so pervasive in the business. Campitelli believes the need for IT risk auditors is growing in other industries as well, as all companies become subject to new regulations, such as the Sarbanes-Oxley Act and the Patriot Act.
What does an IT risk auditor do exactly? It entails looking at everything in the technology infrastructure—networks, operating systems, program change controls, disaster recovery, information security, LANs, WANs and voice networks. You assess the risks of all of these technologies and the way they are being managed. Then you develop a three-year audit plan under which you'll look at every component in the architecture, looking at the high-risk technologies every year and the medium-risk items every other year or third year. It's like sampling New York City restaurants. You never get finished because by the end of the first year, you have changed the infrastructure so much that you have to sample more things.
What kind of skills do you look for in an IT auditor? These are hard-core technology people. They understand Unix, firewalls, networks and operating systems, and they understand them from a risk and control perspective. They don't need to be Java programmers, but they need to understand how to control Java programs and best practices for developing, inventorying, testing and rolling out changes.

Vince Campitelli of Wachovia Corp.

What's your career advice for an IT professional looking to move into IT auditing? The No. 1 quality you need is professional skepticism. You believe everybody and trust no one. It's also all about communication. IT auditors are focusing on new products, new services and new projects. They need to make sure the CIO understands the risk and has a good way of managing it. In my opinion, risk and understanding risk is a major black hole. What's needed is a good dialogue between business management, financial management, IT personnel and IT auditors. You have to come up with a common language that all people understand.

How do you do that? Have a good training curriculum for IT people. For new IT hires, we build in an appreciation for risk and risk assessment controls into the core training. The other thing we do is get senior people to fully support it. That then significantly reduces the challenge because brand-new people are all for it.