The FSA is clearly taking coaching lessons from the SEC, dishing out harsh fines for accidents and mistakes. The latest miscreant, Nationwide Building Society, got slapped with a £980,000 penalty after a laptop which contained sensitive customer data was stolen. The fine would have been £1.4 million but they were given a 30% early settlement discount. (that made me giggle). Which is just as well because reading the detailed account reads like a comedy of errors. In its detailed report, the FSA said:
Nationwide failed adequately to assess the risks in relation to the security of its customer information.
Nationwide had procedures in relation to information security which failed adequately and effectively to manage the risks it faced.
Nationwide failed to implement adequate training and monitoring to ensure that its information security procedures were disseminated and understood bystaff.
Nationwide failed to implement adequate controls to mitigate information security risks, to ensure that employees adhered to its procedures and to ensure that it provided an appropriate level of information security.
Nationwide failed to have appropriate procedures in place to deal with an incident involving the loss of customer information and, as a result,
Nationwide did not respond appropriately and in a timely manner to establish the risks to Nationwide customers of financial crime arising from the theft of a Nationwide laptop computer.
The report then goes on to say that although risk cannot be entirely eliminated, Nationwide did a pretty poor job. The period of failure was December 2004-6. Two years.
Auditors are PwC. What part of Auditing 101 did they miss? It kinda goes like this:
Do you have laptops?
How are they managed? (lots of extra questions here)
How is customer data secured? (more questions on data security model)
What are the procedures in case of loss? (other than ring insurers…)
Is that too hard?
Technorati Tags: audit quality, PwC
