A few years ago, I was speaking on a panel when someone in the audience asked, “What’s the strangest audit finding you’ve ever encountered?” I paused for a moment, then shared this story:
IT infrastructure teams often name their servers based on their interests—astronomy fans might use names like Orion or Andromeda, while fishing enthusiasts might choose species of fish. During a risk analysis, I came across servers with what seemed to be random people’s names. Out of curiosity, I Googled them, and to my surprise, they all belonged to infamous serial killers. My first thought? Is this an audit finding? Do I report it or just walk away slowly?
That moment reinforced a key lesson: in auditing, you never know what you’re going to uncover. That’s why Extreme Auditing exists—the ability to assess anything, no matter how unexpected, disruptive or unfamiliar it may be.
Auditing in 3D: A New Dimension of Assurance
Traditional IT auditing is no longer enough. We were trained to assess stable systems, but technology evolves at a speed that renders old methods obsolete. We can’t just audit what we know—we must learn to audit what we don’t.
Today, auditors don’t just analyze logs and processes. We navigate artificial intelligence, blockchain, cloud environments and even the metaverse. The game has changed, and staying relevant means evolving with it.
New risks emerge as fast as innovation accelerates. But here’s the challenge—many of these risks don’t fit into traditional audit frameworks. Are we prepared to evaluate not just the technology itself but also the trust, ethics and security implications it introduces? How do we audit adaptive systems or entirely virtual environments? Auditors must go beyond evaluation—we must anticipate, challenge and push the boundaries of assurance.
The Metaverse: Where Auditing Goes Beyond the Screen
The internet has evolved from Web 1.0 to Web 3.0—an immersive space where audits won’t just be about checking records but might require interaction within virtual worlds. Are we prepared to audit digital economies, NFTs and identity systems in the metaverse? Because if we’re not, someone else will be.
Auditing is evolving faster in recent years than it has in decades. If we don’t take our skills to the extreme, we risk being left behind. At the ISACA 2025 North America Conference in Orlando this May, I’ll dive into all of this and more—how to audit in 3D, the tools we need and the challenges ahead.
If you want to learn how to audit the future, I’ll see you in Orlando. Just like at Disney parks—if you’re not ready for the next unexpected twist, you might miss the best part of the ride.
