Complex Systems with Patrick McKenzie (patio11) Delve into compliance theatre
24 snips
Mar 26, 2026 A deep dive into how compliance rules spread across vendors and procurement. Discussion of layered security controls and what real audits actually test. Examination of allegations that a compliance vendor sold superficial, templated reports. Concerns about marketing claims, identical reports across firms, and where liability and accountability fit into audit systems.
AI Snips
Chapters
Transcript
Episode notes
Why Compliance Regimes Become Viral
- Compliance regimes are designed to be viral so upstream institutions can force downstream vendors to adopt the same controls.
- Patrick McKenzie explains HIPAA and SOC 2 chains where enterprises demand vendor attestations and BAAs, which spreads compliance across suppliers.
Defense In Depth Is The Point Of Controls
- Real security controls rely on defense in depth: HR offboarding triggers IT deprovisioning, full disk encryption, and logging to bound exposures.
- McKenzie illustrates with the laptop-sold-on-eBay postmortem and layered mitigations to limit data loss.
Audits Must Test The Evidence Not Just The Claim
- Auditors don't just accept checklists; they test samples and verify evidence, e.g., selecting specific departed employees and tracing laptop recoveries.
- McKenzie recounts auditors sampling rows from spreadsheets and causing 'terrified Slack messaging' when gaps appear.