Career Watch

Computerworld -

Vince Campitelli
Title: Managing director, enterprise technology audit
Company: Wachovia Corp., Charlotte, N.C.
What he does: Leads a 60-person audit team focused on identifying and managing risks associated with the use of IT at the $2.4 billion bank, the fourth-largest in the country. In banking and financial services, 70% to 80% of all risk is technology-related, because IT is so pervasive in the business. Campitelli believes the need for IT risk auditors is growing in other industries as well, as all companies become subject to new regulations, such as the Sarbanes-Oxley Act and the Patriot Act.
What does an IT risk auditor do exactly? It entails looking at everything in the technology infrastructure—networks, operating systems, program change controls, disaster recovery, information security, LANs, WANs and voice networks. You assess the risks of all of these technologies and the way they are being managed. Then you develop a three-year audit plan under which you'll look at every component in the architecture, looking at the high-risk technologies every year and the medium-risk items every other year or third year. It's like sampling New York City restaurants. You never get finished because by the end of the first year, you have changed the infrastructure so much that you have to sample more things.
What kind of skills do you look for in an IT auditor? These are hard-core technology people. They understand Unix, firewalls, networks and operating systems, and they understand them from a risk and control perspective. They don't need to be Java programmers, but they need to understand how to control Java programs and best practices for developing, inventorying, testing and rolling out changes.

Vince Campitelli of Wachovia Corp.