In a Type 1 audit, all the auditors look for is whether the company has policies/procedures/controls in effect to obtain the objectives of the company (whatever those may be)
In a Type 2 audit, the auditors will attempt to determine whether the policies and procedures in place are being followed. Whether the controls are effective in achieving the objectives that have been stated.
I work for a software company that recently went through a Type 2 audit. In our case most of what was looked at was our SDLC (software development life cycle) process, version control, etc. They went through our work ticket system & spent a week following more than a few tickets through the entire process: code check out, work produced, QA testing, user testing, peer review, code check in. They spent several weeks over a three month period driving our internal audit & software staff nuts.
Does it mean anything? From our point of view, yes. But, not only does the audit depend on the quality of the auditors, but on the quality & detail of those process & procedure documents that they are auditing.
Arrrr! Tis a good day to be a pirate! The sun, the wind, the spray on your face, the feel of the deck beneath your feet... and it's someone else's turn in the barrel.
Methinks it's time for a tot of rum!
----- A prohibitionist is the sort of man one couldn't care to drink with, even if he drank. -H. L. Mencken
Ditto on the Locus; a solid resource for finding quality SF: lots of reviews, quarterly update on forthcoming books (so you can keep an eye out for favorite authors), yearly awards for best novels (voted on by readers), annual recommended reading list (compiled by the reviewers), interviews with authors & lots more news of the SF community.
Slashdot Mirror
In a Type 1 audit, all the auditors look for is whether the company has policies/procedures/controls in effect to obtain the objectives of the company (whatever those may be)
In a Type 2 audit, the auditors will attempt to determine whether the policies and procedures in place are being followed. Whether the controls are effective in achieving the objectives that have been stated.
I work for a software company that recently went through a Type 2 audit. In our case most of what was looked at was our SDLC (software development life cycle) process, version control, etc. They went through our work ticket system & spent a week following more than a few tickets through the entire process: code check out, work produced, QA testing, user testing, peer review, code check in. They spent several weeks over a three month period driving our internal audit & software staff nuts.
Does it mean anything? From our point of view, yes. But, not only does the audit depend on the quality of the auditors, but on the quality & detail of those process & procedure documents that they are auditing.
Arrrr! Tis a good day to be a pirate! The sun, the wind, the spray on your face, the feel of the deck beneath your feet... and it's someone else's turn in the barrel.
Methinks it's time for a tot of rum!
-----
A prohibitionist is the sort of man one couldn't care to drink with, even if he drank. -H. L. Mencken
Ditto on the Locus; a solid resource for finding quality SF: lots of reviews, quarterly update on forthcoming books (so you can keep an eye out for favorite authors), yearly awards for best novels (voted on by readers), annual recommended reading list (compiled by the reviewers), interviews with authors & lots more news of the SF community.