Grab your shovels and your mules, GRC still has plenty of life in it. San Jose, CA based Agiliance has shown that the GRC space is alive and kicking (at least from the VC perspective) by raising a $10 million round of funding led by Castile Ventures , with participation from Intel Capital , Walden International and Red Rock Ventures . Despite all the noise regarding the downturn in VC activity (no IPO's, etc.) it seems that money is still pouring into the security space as we have reported numerous times since the start of the year. With a dearth of IPO's in the future, it looks like more and more companies (the Big Boys) are turning to acquisition as a strategy of "off-balance sheet R&D". 

Recommend this article...

Comment | Add as favorites (0) | Link to this | Views: 493 | Read more...

In this report , released a few days ago, the PCAOB cites numerous deficiencies in how PricewatershouseCoopers, LLP conducts itself, and its audits. Putting aside all of the accounting specific items and examples in the report, the most interesting paragraph comes at the end of page 6. This is where the PCAOB describes their review of PwC's audit quality control system. Unfortunately, we'll never know if PwC ran afoul in the 8 functional areas inspected unless they fail to remediate their practices within 12 months.

"Any defects in, or criticisms of, the Firm's quality control system are discussed in the nonpublic portion of this report and will remain nonpublic unless the Firm fails to address them to the Board's satisfaction within 12 months of the date of this report."

The following 3 sections of the report are then not provided, dumping us into the Appendix B, which contains a brief but interesting overview of the inspection process itself. As a buyer of audit services, wouldn't a company want to know where they may have issues in the audit process? This approach of shielding the deficiencies from public view only inhibits this. It reminds me of the long debate among vulnerability reseaarchers about how long to give vendors to patch before releasing the exploit to the public. In the the latter case, it is measured in days, not months. Shouldn't we get the same visibility into the firms trusted with helping us maintain our good names?

Recommend this article...

Comment | Add as favorites (0) | Link to this | Views: 243 | Read more...