In my own work, I mention to my peers how everything has changed in today’s Converged Internet/Global Telecommunications world. Liability and accountability rolls down hill. If something happens where the operator is found at fault, that finding does not stop with the operator. It will ‘roll down hill’ to the vendors and now the auditors.
Check out Kim Zetter’s write up on Savvis’s Audit arm being pulled into court by Merrick – In Legal First, Data-Breach Suit Targets Auditor. If successful, we would find Savvis being the first of many companies who will share accountability for shared risk.