How many times have you done a follow along assessment where you wonder, “how the heck did they pass last year?” I can tell you I see this all the time as a QSA. Customers hate it when I tell them they have to something different, larger in scope, costs more money, and it takes longer. I always say, “I don’t know what happened last year, but I point the DSS and say this is what you have to do.
I often wonder if I should report the old QSA, but I come back to; “They used their judgment to pass the company, maybe there is something I don’t know.” As QSAs we use our judgment to make decisions all the time. You may have used yours to let a customer pass when they were not meeting requirements to the letter, but were going a good enough job and the risk was low.
I personally think your job is to just fix the issues and forget about the past – accident of history. If the QSA does this bad practice often enough they will get caught and they will loose their certification.
I would protect yourself by gathering the facts if management decides to take action against you, but your job now is to fix the issue at hand.
Go to the other members of the executive group and tell then you want to use a different auditor this year, not your old company! This way you avoid the issue of “friendly pass”. Don’t get into a blaming war about the past, you will loose.
Just say, “Look, it was an accident of history, I don’t care. You hired me to do a job. I need to use a different auditor to do the job correctly”. If they don’t support you, start looking for another job ASAP. If new company asks why – tell the truth without exposing the names. Just say my ethics don’t allow me to do something I know is wrong. I was being put into a position where I knew it was really wrong and it was a no win situation.
Given your experience, you know what has to get done to protect the company. Likely the execs are going to have a fit given the $, time, resources you need to get the job done right. Lay it out cold and if they refuse, start looking for a new job. Once you are out, send a letter to the board members letting them know they have an issue in the management; let them deal with the execs as a good board should be doing.
If you are the 3rd person in role, likely the folks before you tried and failed; they were shown the door or quit because it was untenable to them. Given that the current regime has shown to be less than competent you might just look for a new job now and avoid the *&^% storm you are about to start up. If you walk or get fired; you need to warn your team about the issues and possible blow back on their careers if something bad should happen to the company due to a breech.
The engineer in me says try to stick it out and fix the issue. If you succeed you have a great victory; management will respect you for doing a hard job; but that is what you signed up to do. The experienced manager in me says walk out now before you damage your carrier; there are lots of other good companies looking for folks like you.
I guess I will add this; if the violations are really flagrant; open ports, segmentation issues, patching issues; no PEN testing... - stuff that really put the company at risk then you should report the QSA. You did not spell out how bad the violations where; so use your judgement here. Be mindful that you don't know what happened last year or the years before.