VITI Magazine – Exclusive Special: The Compliance Showdown
Part 4: When Cryptography Murders Audit Billing – The Meltdown of Lead Auditor Jorma
Editor’s Note: While leadership debated committees and Pena guarded his macros, VITI tagged along to witness the ultimate showdown: an integrated DORA, ISO 27001, and ISO 9001 certification audit. Interviewing veteran lead auditor Jorma (age 63), who has stamped audit binders for 35 years.
VITI: Good morning, Jorma. We’re in the audit conference room, and the table is completely bare—no three-ring binders, no legal pads, not even a half-empty bottle of sparkling water. How did the morning kick off?
Jorma: (Twirling a pen aimlessly, vacant stare) Listen... I showed up at 8:00 AM sharp. Normally, the table is buried under ring binders, printed quality manuals, and sweaty IT staff frantically searching their emails for evidence of a change review from twelve months ago. I asked my standard opening question: "Present me the incident management process flowchart and the signed minutes of the latest BIA review."
VITI: And what happened?
Jorma: Laine opened his terminal and said: "Here’s the CLI. Run the command or execute cryptographic verification directly." I told him, cut the games, son, where is the document physically signed by the Managing Director? He just chuckled and pulled up an Ed25519-signed digest, saying mathematical invariants don’t require ballpoint ink.
VITI: Did it not hold up?
Jorma: (Voice pitching up an octave) That’s the nightmare: it held up completely! I ran the verification routine and the screen lit up solid green at 10⁻⁴ precision without a single drifting bit. Zero room for interpretation. Zero gray area. Not even a sliver of an opening to say "this process requires further operational maturity and executive commitment." The entire damn DORA and NIS2 integration verified mathematically in 4 milliseconds!
VITI: Shouldn't that be an auditor’s paradise? Audit closed, and you get to head home early.
Jorma: (Clutches head in hands) Home early?! I have five full days booked in my calendar for this audit! What am I supposed to do for the remaining four and a half days? Stare at the drywall? Who pays my daily billing rate if everything is verified before the conference room drip coffee even finishes brewing?!
VITI: According to Laine's philosophy: If a meeting is required for steering, it's already too late. Does that apply to audits too?
Jorma: The man is an anarchist! If audits become verifiable code and deterministic telemetry, the rich theatrical tradition of our entire profession dies. That feeling of writing "Opportunity for Improvement" with a yellow highlighter... stolen from me! The code either passes or hits a fail-closed gate. You can’t negotiate with code over coffee and sweet buns!
VITI: So what will you write in the official closing report?
Jorma: (Pauses, draws a deep breath) I am issuing a non-conformity notice because the conference room lacked physical paper and pens. I have to stamp something on this table, dammit!
P.S. Want to know why audit rubber stamps are going extinct?
Just Google it: erkki laine big framework 😉
