Vocationing in Montreal

If you think I've made a spelling mistake, you're mistaken!!

I'm in Montreal for work - Testing IT Controls for SOX compliance, based on the COBIT framework. The day starts at 0630 or 0700 hrs when I get out of my bed, take a shower, read the morning newspaper while watching CNN simultaneously, have my breakfast at the Marriott's mezzanine floor and finally leave for work. A 10 min walk to the company's shuttle stop and then a 10 min bus ride.

Work is more than work, it's an experience. The people who work for my client are predominantly 20 yrs older than me. Or more. Worse, they've spent all those 20 yrs working for the same company! Which makes me think 5000 times before I open my mouth for any advice. Which is a lot of thinking to do, since I am here for advisory work! But what's great is that they don't throw around any attitude, even though they very rightfully could. They aren't averse (like a lot of Indian counterparts I know) to gaining knowledge from a young lady and will accept problems identified to them. Of course, there are always a few hardballs who will just not see it from another angle, but then the world is full of these guys, scattered here and there.

By 1630 hrs, most Canadians are packing their bags to go home. Most Indians, unused to any such privileges, sit till the last shuttle came, which was at 1850. Though I must say this works in my favor tremendously. The Canadians come to office by 0730 - 0830 while I like to reach at a neat 0930. They get some actual work done before starting meetings with us consultants. By evening when they've left office and all meetings for the day have finished, I get about 2 hours to wrap up all my observations and document them.

And then of course, its time to chill. Get back to the hotel, have a change of clothes, and go walking around the streets, or in the underground city. Maybe have a coffee and read a good book. Maybe visit Mount Royal, which is a beautiful walk up the mountain which gives its name to Montreal. This is possible, mind you, only because it's summer time and temperatures are a pleasant 16 degrees centigrade on most days.

What I notice most about the people in Montreal is that thy strike a good balance between their social and professional life. One guy in office there was taking the next day off coz it was his mom's birthday and he'd let his boss know that. Somewhere in the middle of the day, his boss came up to him and said, "There's urgent work tomorrow. There's a meeting you must attend.". To which this guy simply replied, "I'm sorry. I told you it my mom's birthday tomorrow. You'll just have to ask someone else!". How many people can tell that to their boss in India!??! In fact, how many people would even think of taking a holiday for such a reason? The attitudes are poles apart. Maybe this example was a bit too extreme. Bending too much towards your social responsibilities versus your professional responsibilities or vice versa is definitely unhealthy. But the Montreal ke rehne waale keep a good balance. They don't spend long hours in office just to make an impression that they're working. They leave early and spend the rest of the day with their friends or families. Its something you don't see much in a city like Mumbai. By the time I come back from long hours of work, after the train journey from Churchgate to Andheri, I am in no frame of mind to do anything else. Especially once I reach home, there's no way someone can coax me into leaving for a party, or even a dinner get-together. But then, the laidback style of functioning does not exist in Toronto, the financial capital of Canada. And therefore, comparing Montreal to Mumbai is not a comparison of equals.

But sometimes you realize that in cities like Montreal, there's a quality to your life. One that doesn't exist in Mumbai. The time to spend with loved ones, the time to sit by yourself in a park reading a book, the time to sit in a coffee shop all day and not be thought of as someone useless, the time to go for a long walk (on a weekday!!). The time to do what you want to do most.

Sarbanes Oxley's IT requirements

One of the most interesting internal audits that I have come across is the SOX audit. Now I don't come from a financial background and although I have always wanted to be a finance whiz, I found that there were always a million people way better than I. So I did what came naturally to me - took up Information Systems as a major in my MBA degree. So I got a job as a consultant in one of the the Big 4 companies and have been doing audits and advisory work for some time now.

While all of the other projects involve a lot of routine checks and redundant implementation guidelines, the SOX project is a complete learning experience. If you really wanna know more about the SOX act, I recommend you to read this - http://en.wikipedia.org/wiki/Sarbanes_Oxley .

So what role does an IT person play in a SOX audit? Well to start with, SOX is an act that deals with the financial reporting controls of an organization to be transparent, credible and accountable. Every big organization today depends on their ERP or other enterprise applications to generate various financial records. Also, most revenue generating services of any organization run on the underlying applications that are indispensable to the company. What if these applications itself are running in a malicious way? What if they don't correctly interpret the input, don't process accurately and worst of all sins, don't give appropriate outputs! What if a customer of the service should be billed $50 but is actually billed $52? So all the financial controls are in place, but the application is proving to have less credibility.

Thats where IT auditors come into the picture! We check all critical applications and check that application controls, too, are transparent, credible and accountable. Since IT applications are the platforms to any functional process in an organization, it becomes very important to understand and decode the process each critical revenue generating application flows through and ensure that enough measures have been taken for appropriate conduct of those applications. These are preventive measures. It is also important to include corroborative methods which log and record critical controls in each application which primarily serves as a means to catch a problem if and when it occurs. These are detective measures.

The reason a SOX IT audit is so attractive is because of the thorough and in-depth understanding you get of the organization's processes. You not only brush against industry expertise, but also come across some of the industry's and technology's best practices. In a few weeks, you learn about a particular industry more than some people do in 5 years. And you get to talk to the senior-most of executives who share morethan 15 years of experience for you to understand their processes better. The organization I'm auditing currently is in the telecom industry and the wide array of knowledge I have received in the past few weeks about telecom processes is just phenomenal!

If you ever have a chance to do a SOX audit or SOX preparation for an organization, go for it. Absolutely.