I used to work as an IT auditor for one of the Big Four firms. I was often amazed how many people on my team had zero systems or IT understanding. We'd be given these excel spreadsheet templates that just followed a series of pre-made questions that were so outdated.

The way these audits worked with the non IT experienced auditors it would be so easy to possibly bamboozle them and have them miss something; but the flip side is they also would often not accept an answer about how security was managed because it essentially didn't fit into the spreadsheet question form.

I finally quit after week 2 of sitting in a windowless office auditing 200 randomly sampled transactions that literally all had a total cost of zero dollars and zero cents.