How permanent are some of the pandemic-induced changes going to be?
It's interesting that you brought up the whole inspection process, the whole certification process, the whole auditing process. I think that a lot of people for a long time did these audits in an impromptu cycle, they had a process that was well documented, but they didn't follow that process completely. They'd set up the war room. They'd cover a little bit each day, depending on who was available. I always assumed that the audit was a better audit, because people couldn't just plan their response. They had to do a little bit off the cuff and they had to riff it a little bit. And they didn't know when something was going to be inspected, so there was a little surprise factor. I always felt web trust audits and things like that were done in that way, because it lended some credibility to it. Do you think you've lost some of that credibility by having to be more regimented and more thoroughly planned out as to when something is going to happen?
I don't think so. There's always a bit of an adversarial relationship between an auditee and an auditor. Which is why I think compliance is not the same thing as security. Your objective is to provide them the necessary information that they'll understand, not so much the larger picture. We're not seeking advice, we're seeking conformance assessment. There was too much faith put into these physical assessments of conformity, in that you based conformance on what you saw was correct at this particular time. Auditors are now being forced to recognize there's more of an adversarial relationship than a collaborative one. You might be taking a more collaborative approach, but their brand is dependent upon them doing competent assessment, and so that their assertions are actually valid. And I think that will manifest into more automation, not just in gathering of evidence, but producing reliable, verifiable evidence. I think that's an interesting trend that maybe isn't directly apparent when looking at the impacts of COVID, but is something that I think we might be on the cusp of.
In the academic sector, the ability to offer virtual and/or hybrid learning is now going to be a viable option instead of being reserved for certain programs or for-profit institutions.
Technology adoption and perhaps even innovation (particularly in higher-ed) will be viewed as a business-critical process rather than a distraction. Or at the very least, given more consideration and attention than often received pre-pandemic.