COMP 6660 · Enterprise Cybersecurity Cybersecurity Auditing

00 Introduction

Lesson 6.1 examined governance, Lesson 6.2 examined policy, Lesson 6.3 examined risk management, Lesson 6.4 examined compliance, and Lesson 6.5 examined awareness. Each of these describes what the enterprise intends to do. Auditing is how the enterprise determines whether it is actually doing it.

Every enterprise believes it has controls. Every enterprise believes its policies are followed, its processes are operating, and its risks are managed. Some of these beliefs are correct; many are not. The gap between what an organisation believes about its security and what is actually true is where incidents occur — because the control that everyone assumed was working was not, and no one had independently checked.

Auditing is the discipline through which that gap is identified. It provides independent, structured, evidence-based assessment of whether controls are designed appropriately and operating effectively. It provides the board and executive with assurance that the security programme is achieving what it is intended to achieve — or with the information required to act when it is not. And it provides the organisation with the findings that drive improvement.

Auditing also has a hard edge. Regulators require it; certification bodies require it; customers require it; financial audit depends on it. Where security controls support financial reporting — access controls, change management, IT operations — internal audit assesses them as part of the financial audit, with consequences for the enterprise's attestations. Where regulation imposes obligations, regulatory examination functions as audit, with the power to enforce findings. Where customers demand assurance, third-party audit reports are the mechanism through which that assurance is provided.

This lesson examines cybersecurity auditing in detail. It establishes why auditing matters and what happens in its absence. It distinguishes auditing from the activities it is frequently confused with — assessment, monitoring, compliance testing, and penetration testing. It examines the assurance landscape — internal audit, external audit, certification audit, regulatory examination, and third-party assessment — and how they relate to one another. It examines the standards and frameworks that govern audit practice. It examines risk-based audit planning — how the audit universe is defined and how the audit plan is derived. It examines the audit process in detail — planning, fieldwork, evidence, findings, reporting, and follow-up. It examines audit evidence — the types, characteristics, and sufficiency of evidence. It examines findings, reporting, and remediation — how findings are classified, communicated, and resolved. It examines follow-up and closure — how findings are tracked to completion. It examines how to work effectively with auditors. And it closes with the pitfalls that recur across audit programmes.

The material here builds directly on Lessons 6.1–6.5 — auditing verifies governance, tests policy compliance, checks that risk management is operating, assesses compliance with obligations, and evaluates whether awareness is achieving its objectives. It prepares for the resilience material in Lessons 6.7–6.9, which are frequently the subject of audit findings, and for Lesson 6.10, where emerging assurance approaches — continuous auditing, automated control monitoring — are examined.

01 Learning objectives

By the end of this lesson you should be able to:

These objectives contribute to Unit 6 outcomes U6.4 (auditing and assurance) and U6.2 (compliance and assurance), and to Module 3 outcomes M3.4 and M3.5. See the Unit 6 learning outcomes page for the full mapping.

02 Why cybersecurity auditing matters

Auditing matters because organisations cannot reliably assess their own controls. The people who design a control believe it works; the people who operate it believe they follow it; the people who own the risk believe it is being managed. Independent assessment tests those beliefs against evidence — and frequently finds that the gap between belief and reality is the source of the enterprise's exposure.

What audit failure looks like

Audit failures are recognisable, and the patterns repeat:

• No internal audit of security. The security programme is never independently assessed — so management's view of its own effectiveness is never tested.
• Audit independence compromised. Internal audit reports to the CIO whose systems it must assess; the CISO is treated as a second line rather than a management function; the audit function has no direct access to the board.
• Audit findings are closed without remediation. Findings are marked "closed" without evidence that the underlying issue was addressed — so the finding recurs in a subsequent audit.
• Audit findings accumulate without action. The same findings appear year after year, with no progress and no consequence.
• Risk acceptance is informal. Findings that cannot be remediated are closed without a formal acceptance decision — so no one is accountable for the residual risk.
• Audit is treated as an exam. Management prepares for the audit rather than operating the controls — producing accurate findings for the period under review and no sustained improvement.
• Audit findings are contested rather than addressed. Management disputes the finding instead of remediating the issue — producing adversarial relationships and concealing the underlying problem.
• Audit scope is narrow and static. The same systems are audited every year while emerging risk areas are never examined.
• Audit is decoupled from risk management. The audit plan is not informed by the risk register, and the risk register is not informed by audit findings.
• Root cause is not addressed. Findings are remediated individually while the underlying condition that produced them persists — producing a new finding the following year.

03 What auditing is — and is not

Auditing is frequently conflated with the other assurance activities that surround it — assessment, monitoring, compliance testing, and penetration testing. The distinctions matter because each serves a different purpose, is performed by a different party, and produces a different type of assurance.

The assurance activities distinguished

The distinctions have practical consequences:

• Audit is independent; assessment is not. The security function assessing the security function's own controls is not audit — it is assessment. The distinction determines whether the board can rely on the output.
• Audit tests design and operating effectiveness. Monitoring tests whether the control is operating now; audit tests whether the control is designed to address the risk and whether it has operated consistently over the period.
• Audit concludes; assessment informs. Audit produces an opinion — the control environment is adequate, or it is not. Assessment produces information — where the gaps are and what to do about them.
• Audit is periodic; monitoring is continuous. Audit operates on an audit cycle; monitoring provides continuous visibility. Both are necessary — audit provides depth, monitoring provides coverage.
• Penetration testing tests exploitation; audit tests control. A penetration test may find no exploitable vulnerability while the underlying control environment is inadequate — and an audit may find significant control weaknesses without identifying a specific exploitable vulnerability.
• They are complementary. Audit informs risk assessment; risk assessment informs audit planning; monitoring provides evidence for audit; penetration testing provides evidence of control effectiveness. Mature programmes use all of them together.

Common misconceptions about auditing

Characteristics of effective auditing

• Independent. The audit function does not report to the people whose controls it assesses, and has direct access to the board or audit committee.
• Objective. Findings are based on evidence, not on opinion, preference, or organisational politics.
• Risk-based. Audit effort is directed toward the areas of greatest risk — not distributed evenly across the audit universe or allocated by history.
• Competent. Auditors possess the technical, organisational, and communication skills required to assess the areas under review.
• Evidenced. Findings are supported by sufficient, reliable, and relevant evidence.
• Reported. Findings reach the people who can act on them — management, executive, board, and where required, regulators.
• Tracked. Findings are monitored to closure, with evidence that remediation has occurred.
• Constructive. Audit is positioned as a source of improvement, not as an adversary — and management engages with it on that basis.
• Continuous. Audit operates across the year — not in a single annual cycle.
• Improving. The audit function is itself assessed and improved — through quality assurance, through external review, and through the outcomes of its work.

04 Types of audit and the assurance landscape

Enterprises receive assurance from multiple sources — internal audit, external audit, certification bodies, regulators, and third parties. Understanding the landscape clarifies what each provides, what each requires, and how they relate to one another.

The assurance landscape

Internal audit

Internal audit is the enterprise's own independent assurance function. Its distinguishing characteristics:

• Independence. Internal audit reports functionally to the audit committee and administratively to the CEO — not to the functions it audits. Independence is the foundation of its value.
• Objectivity. Auditors do not design, implement, or operate controls — they assess them. Where internal audit provides consulting, safeguards protect objectivity.
• Enterprise-wide scope. Internal audit covers the whole enterprise — not only security. Cyber audit is one component of a broader audit programme covering financial, operational, compliance, and strategic risk.
• Risk-based planning. The audit plan is derived from the enterprise risk assessment — directing audit effort toward the areas of greatest risk.
• Board reporting. Internal audit reports to the audit committee — providing the board with independent assurance and with escalation for findings that management does not remediate.
• Professional standards. Internal audit operates to the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing — which govern independence, competence, planning, evidence, and reporting.
• Quality assurance. Internal audit is itself assessed — through internal quality assurance and periodic external assessment.

External audit

External audit provides independent assurance to parties outside the enterprise — shareholders, regulators, and, in attestation engagements, customers:

• Financial audit. The external audit opinion on the financial statements depends on the effectiveness of IT controls supporting financial reporting — access controls, change management, IT operations, and segregation of duties. Where those controls are inadequate, the auditor may extend testing, qualify the opinion, or report an internal control deficiency.
• Certification audits. ISO/IEC 27001 certification is awarded by an accredited certification body following a documented audit process — a Stage 1 documentation review, a Stage 2 implementation assessment, and periodic surveillance audits.
• Attestation engagements. SOC 2 reports are issued by independent CPA firms against the AICPA Trust Services Criteria — frequently with a defined scope, period, and set of criteria agreed with the enterprise.
• Regulatory examination. Sector regulators examine the enterprise's compliance with regulatory requirements — with the power to impose findings, fines, and remedial orders. Regulatory examinations are frequently more extensive and more consequential than internal audit.
• Second-party audit. Customers exercise the contractual right to audit — either directly, through a site visit or questionnaire, or through acceptance of a certification or attestation report.

The three lines model and assurance

The three lines model — examined in Lesson 6.1 — clarifies the relationship between assurance providers:

• First line — management. Owns and manages risk; operates controls; performs control self-assessment and monitoring.
• Second line — risk and compliance. Provides expertise, guidance, and challenge; performs compliance testing, control assessment, and risk assessment.
• Third line — internal audit. Provides independent assurance to the board and audit committee on the design and operating effectiveness of controls and risk management, including the effectiveness of the first and second lines.
• External assurance providers. External audit, certification bodies, and regulators provide assurance the enterprise cannot provide to itself — frequently relied upon by parties outside the enterprise.

Coordinating assurance

Where the enterprise receives assurance from multiple providers, coordination is necessary to avoid duplication and gaps:

• Mapping assurance coverage. Mapping which areas are covered by which assurance providers, and identifying where coverage is duplicated or absent.
• Reliance on the work of others. Where permitted by standards, external auditors may rely on internal audit's work, and internal audit may rely on the second line's work — reducing duplicate effort.
• Coordinated planning. Audit plans developed collaboratively — with internal audit, external audit, and the second line coordinating scope and timing.
• Shared findings. Findings from one assurance activity informing the planning of the others — so that areas with prior findings receive appropriate attention.
• Consistent standards. Common criteria for assessing control effectiveness — so that the enterprise can reconcile the views of different assurance providers.
• Single point of coordination. Typically the chief audit executive, working with the CISO and the risk function — to ensure that assurance is comprehensive and efficient.

05 Audit standards and frameworks

Audit practice is governed by professional standards that define how audits are conducted, how evidence is collected, how findings are reported, and what independence and competence are required. These standards are what give audit its rigour and its credibility.

The principal audit standards

The IIA standards — the reference for internal audit

The IIA standards define internal audit practice in detail. Key requirements relevant to cybersecurity audit:

• Purpose of internal auditing. Internal auditing enhances and protects organisational value by providing risk-based and objective assurance, advice, and insight.
• Independence. The chief audit executive reports functionally to the board (typically the audit committee) and administratively to the CEO — ensuring the function is free from interference.
• Objectivity. Auditors must be objective and free from conflicts of interest — and must not audit activities for which they have had recent responsibility.
• Competence. Auditors must possess the knowledge, skills, and other competencies needed to perform their responsibilities — including, where the audit requires it, technical IS and security expertise.
• Risk-based planning. The audit plan must be based on a documented assessment of risk — and must be aligned with the organisation's goals and objectives.
• Engagement planning. Each engagement requires a plan defining objectives, scope, timing, and resource allocation — based on the risk of the area under review.
• Evidence. Sufficient, reliable, relevant, and useful information must be collected to support engagement conclusions.
• Communication. Engagement results must be communicated to the appropriate parties — including findings, conclusions, and recommendations.
• Monitoring progress. The chief audit executive must establish a process to monitor the disposition of results communicated to management.
• Quality assurance. Internal audit must maintain a quality assurance and improvement programme, including internal and external assessments.

ISACA ITAF — standards for IS audit

ISACA's ITAF provides standards specifically for auditing information systems and technology — the closest fit for cybersecurity audit:

• General standards. Covering the IS audit function — independence, competence, professional judgement, due care, and quality assurance.
• Performance standards. Covering the conduct of IS audit work — engagement planning, risk assessment, evidence, and documentation.
• Reporting standards. Covering the communication of results — content, format, distribution, and follow-up.
• Guidelines and tools. Detailed guidance on specific audit areas — including security, cloud, and emerging technology.
• COBIT alignment. ITAF is closely aligned with COBIT — which provides the control framework against which IS audit is frequently conducted.

Control frameworks used in security audit

Audit assesses controls against a framework. The principal frameworks used in cybersecurity audit:

• ISO/IEC 27001 Annex A. The control catalogue underlying the ISMS standard — used as the control framework for ISMS audit and frequently as the reference for other security audits.
• NIST SP 800-53. The comprehensive control catalogue — with SP 800-53A providing assessment procedures for each control.
• CIS Controls. The prioritised set of technical and organisational controls — frequently used as the framework for technical control audit.
• COBIT. The IT governance and management framework — used as the reference for IT control audit.
• NIST Cybersecurity Framework. The organising structure for security activities — used as the reference for programme-level assessment.
• PCI DSS requirements. The specific requirements applicable to cardholder data environments.
• IEC 62443. The industrial automation and control systems security standard — used for OT security audit, as examined in Lesson 5.8.
• Cloud security frameworks. CSA CCM, the CIS Foundations Benchmarks for cloud, and cloud provider well-architected frameworks — used for cloud security audit.

Standards, frameworks, and the audit

In practice, an audit uses:

• Audit standards to govern how the audit is conducted — independence, evidence, documentation, reporting.
• Control frameworks to define what is being assessed — the control objectives and requirements against which findings are made.
• Assessment procedures to define how each control is tested — the specific steps and evidence required.
• Regulatory requirements to define the mandatory criteria that the enterprise must meet.
• Enterprise policy to define what the enterprise itself has committed to — which audit also tests against.

The combination is what makes an audit coherent — the audit is conducted to professional standards, against a recognised control framework, using defined assessment procedures, and testing compliance with both external requirements and internal policy.

06 Risk-based audit planning

Audit resources are finite. There is always more that could be audited than there is capacity to audit it. Risk-based planning is how the audit function decides where to direct its effort — toward the areas of greatest risk, rather than evenly across the audit universe or by historical convention.

Defining the audit universe

The audit universe is the complete set of auditable entities, processes, systems, and activities within the enterprise. For cybersecurity, the universe typically includes:

• Governance and strategy. Security governance structures, strategy, policy framework, roles and responsibilities.
• Risk management. Risk assessment processes, risk register management, risk treatment, and risk reporting.
• Compliance. Obligation identification, compliance monitoring, regulatory reporting, and control mapping.
• Identity and access management. Access provisioning, privileged access, authentication, access review, and identity governance.
• Data protection. Data classification, encryption, data loss prevention, and data lifecycle management.
• Infrastructure and platform security. Operating systems, databases, cloud environments, containers, and virtualisation.
• Network security. Network architecture, segmentation, firewalls, remote access, and wireless.
• Application security. Secure development, application controls, and API security.
• Endpoint and device security. Endpoint protection, mobile devices, and IoT.
• Third-party and supply chain. Supplier assessment, contractual controls, and ongoing assurance.
• Incident management. Detection, response, and post-incident improvement.
• Business continuity and recovery. Continuity planning, backup, recovery, and testing.
• Awareness and human factors. Awareness programme design, delivery, and effectiveness.
• Programme management. Security programme delivery, investment, and reporting.

Assessing audit risk

Each auditable entity is assessed for audit risk — the risk that a material control weakness exists and would not be detected without audit. Audit risk is typically assessed across dimensions:

Building the audit plan

The audit plan translates the audit universe and the risk assessment into a schedule of engagements:

07 The audit process

The audit process is the sequence of activities through which an audit engagement is conducted. It follows a defined structure — planning, fieldwork, findings, reporting, and follow-up — that is consistent across audit types and professional standards.

The audit process

08 Audit evidence

Audit findings rest on evidence. The quality of the evidence determines the reliability of the finding — and therefore the reliability of the entire audit. Understanding what constitutes good evidence is essential for both auditors and for the functions being audited.

Characteristics of audit evidence

Evidence must be sufficient, reliable, relevant, and useful:

Types of audit evidence

Evidence in the security context

In cybersecurity audit, evidence typically includes:

• Policy and standard documents. Evidence that requirements have been defined and approved.
• Configuration evidence. Screenshots, configuration exports, and system reports — showing how systems are configured.
• Log evidence. System logs, application logs, and security logs — showing what has occurred.
• Access records. Access requests, approvals, and reviews — showing how access was granted and reviewed.
• Change records. Change requests, approvals, testing records, and deployment records — showing how change was managed.
• Incident records. Incident tickets, investigation notes, and post-incident reviews — showing how incidents were handled.
• Training records. Completion records, attendance, and acknowledgement — showing that training was delivered.
• Third-party evidence. Contracts, assessment reports, certifications, and audit reports — showing the state of supplier controls.
• Testing evidence. Penetration test results, vulnerability scan results, and control testing records.
• Governance evidence. Committee minutes, decisions, and reporting — showing how governance operated.

Evidence quality issues

Common problems with evidence:

• Evidence of existence, not effectiveness. A control that exists is not the same as a control that works. Evidence of documentation is not evidence of operation.
• Evidence from the wrong period. Testing performed outside the period under review — showing that the control works now, not that it worked when required.
• Evidence that is easily fabricated. Screenshots and spreadsheets can be manipulated; system-generated evidence and independent confirmation are more reliable.
• Evidence that is incomplete. A sample that does not represent the population; logs that have been truncated; records that have gaps.
• Evidence that requires interpretation. Where the auditor must interpret what the evidence means, the conclusion is less reliable than where the evidence speaks for itself.
• Evidence that is not documented. Where the evidence was reviewed but not retained, the conclusion cannot be verified.
• Over-reliance on inquiry. Management's assurance that a control operates is not evidence — it must be corroborated.
• Evidence prepared for the audit. Records created specifically to satisfy the auditor rather than as part of normal operation — which do not demonstrate how the control actually operates.

Preparing for audit evidence collection

The audited function can significantly improve the audit experience by preparing evidence in advance:

• Understand what will be requested. Ask the auditor in advance what evidence will be required — and prepare it.
• Maintain evidence as part of normal operations. Where evidence is collected and retained as part of how the control operates, preparing for audit is straightforward.
• Organise evidence logically. Evidence that is organised by control, by period, or by system is easier for the auditor to review — and reduces the burden on the audited function.
• Provide evidence promptly. Delays extend the audit and increase the burden on everyone. Establish a single point of contact for evidence requests.
• Retain evidence. Evidence required for audit should be retained per the retention schedule — not deleted because it is no longer needed operationally.
• Be honest about gaps. Where evidence is missing, say so — rather than fabricating or reconstructing. Auditors respond better to acknowledged gaps than to concealment.

09 Findings, reporting, and remediation

The audit finding is the unit of output from an audit engagement. A well-constructed finding communicates what was found, why it matters, why it occurred, and what should be done — in a form that is actionable and that can be tracked to closure.

Anatomy of an audit finding

Root cause analysis

Root cause analysis is the most valuable part of finding development — because addressing the root cause prevents the finding from recurring, while addressing only the symptom produces a finding that returns.

Common root causes of security findings:

• Control design deficiency. The control was not designed to address the risk — the design itself is inadequate.
• Process not followed. The control was designed appropriately but was not operated — frequently because the process is unclear, inconvenient, or unenforced.
• Insufficient resources. The function responsible for the control lacks the people, time, or tools to operate it — a resourcing problem, not a process problem.
• Insufficient skills. The people responsible for the control do not have the knowledge or capability to operate it correctly.
• Unclear accountability. No one is accountable for the control — so no one operates it.
• Inadequate monitoring. The control fails silently — because no one monitors whether it is operating.
• Change. The environment changed — new systems, new personnel, new processes — and the control was not updated.
• Tooling limitation. The available tools cannot enforce or monitor the control — a technology gap.
• Competing priorities. The control was de-prioritised in favour of other work — an organisational decision with security consequence.
• Culture. The organisation does not value the control — so it is not operated, and non-operation is not challenged.

Root cause analysis frequently reveals that the same underlying cause produced multiple findings — so addressing the cause resolves several findings at once. This is where audit produces the greatest value.

Finding ratings

Findings are typically rated to communicate severity and to prioritise remediation. Rating schemes vary, but typically include:

Rating schemes should be:

• Defined. With clear criteria for each rating — so that ratings are consistent across engagements and across auditors.
• Risk-based. Based on the consequence of the weakness, not on the number of instances or the ease of remediation.
• Consistent. Applied consistently — so that management can prioritise accurately and so that trends are meaningful.
• Proportionate. With remediation timeframes proportionate to the risk — not uniformly applied regardless of severity.
• Documented. With the rationale for the rating recorded.

The audit report

The audit report communicates the audit's conclusions. A typical report includes:

• Executive summary. The overall opinion and the most significant findings, written for senior readers who will not read the detail.
• Background and scope. What was audited, why, over what period, and against what criteria — and explicitly, what was excluded.
• Overall opinion. The auditor's conclusion on the adequacy of the control environment in the area under review.
• Detailed findings. Each finding with its condition, criteria, cause, effect, recommendation, rating, management response, and remediation plan.
• Positive observations. Where controls are operating well — providing balance and recognising effective practice.
• Appendices. Supporting detail — methodology, evidence sources, and detailed test results.

Report distribution depends on the audit type and the finding severity:

• Management of the audited area. Always — the report is theirs to act on.
• Executive leadership. Where findings are significant or where cross-functional action is required.
• Audit committee or board. For internal audit reports, and for any finding of critical or high severity.
• Regulators. Where required by regulation, or where the finding relates to a regulatory obligation.
• External audit. Where the finding relates to controls supporting financial reporting, or where reliance is being placed on internal audit's work.
• Customers. Where the enterprise is the supplier and the customer has a right to audit or requires notification of material control weaknesses.

Management response and remediation

Management's response to a finding is a formal part of the audit record. A response includes:

• Acceptance or disagreement. Management either accepts the finding or provides a documented rationale for disagreement.
• Remediation plan. The specific actions management will take to address the finding.
• Owner. The named individual accountable for remediation.
• Target date. When remediation will be complete.
• Interim measures. What will be done in the meantime to reduce the risk — where remediation cannot be immediate.
• Risk acceptance. Where management chooses not to remediate, a formal risk acceptance — approved at the appropriate level for the severity of the finding.

Disagreement with a finding is legitimate — but must be based on evidence or on a different interpretation of the criteria, not on preference. Where disagreement cannot be resolved, the finding is escalated — typically to the audit committee, which has the authority to determine whether the finding stands and whether remediation is required.

Reporting findings to governance

Findings that are not remediated within their target date are typically reported to the audit committee — which is the mechanism through which audit's findings acquire consequence:

• Summary reporting. Aggregate data — findings by severity, by area, by age, and by status — provides the committee with a view of the enterprise's control posture.
• Overdue findings. Findings past their target date, with management's explanation and revised plans.
• Recurring findings. Findings that have appeared in multiple audits — indicating that remediation has not addressed the root cause.
• Accepted risks. Findings where management has chosen to accept the risk — with the rationale and the authority for acceptance.
• Critical and high findings. Reported individually, with the remediation plan and the current status.
• Trends. Whether the enterprise's control posture is improving or deteriorating — and the reasons.

10 Follow-up, closure, and continuous improvement

Follow-up is the process through which audit findings are tracked to closure. It is frequently the most neglected part of the audit process — and the part that determines whether the audit produces improvement or documentation.

The follow-up process

11 Working effectively with auditors

Security professionals spend a significant proportion of their time being audited — by internal audit, by external audit, by regulators, by certification bodies, and by customer assessors. How the security function engages with audit determines whether the engagement produces improvement or friction.

Principles of effective engagement

• Treat audit as a source of information, not as an adversary. The audit is identifying control weaknesses that the security function may not have seen, or may have underestimated. That information is valuable.
• Be prepared. Understand the scope in advance. Prepare evidence. Make the right people available. Preparation reduces the burden on both sides and improves the quality of the engagement.
• Be transparent. Where there are gaps, acknowledge them. Where there are known risks, disclose them. Where there have been incidents, explain them. Concealment is discovered eventually, and it damages credibility.
• Be responsive. Respond to requests promptly. Delays extend the audit and increase the burden on everyone. Assign a single point of contact for the engagement.
• Engage with findings constructively. Where findings are correct, accept them and remediate. Where the finding is contested, disagree with evidence — not with preference.
• Focus on root cause. The finding describes a symptom; the root cause explains the underlying condition. Address the root cause — and the finding does not recur.
• Use the findings. Findings are an input to the security roadmap, to the risk register, and to investment decisions — not merely a compliance obligation.
• Build the relationship. Audit is a long-term partner. Invest in the relationship — with regular communication, with transparency, and with mutual respect for the different roles.

Preparing for an audit

Preparation significantly affects the audit experience:

• Understand the scope. Read the engagement plan. Know what is being audited, over what period, and against what criteria.
• Identify the key contacts. Assign a single point of contact and identify the control owners who will be involved.
• Prepare the evidence. Evidence for the controls under review — organised, complete, and accessible.
• Brief the participants. Ensure that everyone who will be involved understands their role and is prepared.
• Review the criteria. Understand the policy, standard, or regulation against which the controls will be assessed.
• Conduct a pre-audit self-assessment. Identify where the control weaknesses are likely to be, and prepare the explanation.
• Prepare the remediation plan in advance. Where known weaknesses exist, have a remediation plan ready — this demonstrates that management is on top of the issue.
• Schedule the engagement appropriately. Avoid peak periods and ensure that key personnel are available.

Responding to findings

The response to a finding determines what happens next:

• Accept and remediate. Where the finding is correct, accept it and commit to remediation — with a plan, an owner, and a target date.
• Accept and escalate for risk acceptance. Where the finding cannot be remediated — due to technical constraints, resource limits, or operational impact — escalate for formal risk acceptance by the appropriate authority.
• Disagree with evidence. Where the finding is considered incorrect, provide evidence that demonstrates the control operates as required — or that the criteria do not apply.
• Negotiate scope where appropriate. Where the finding is correct but the recommended remediation is disproportionate, propose an alternative that addresses the risk more effectively.
• Address the root cause. Where the finding is a symptom of a systemic issue, address the systemic issue — and document the broader remediation.
• Track to closure. Ensure that remediation is completed, verified, and closed — rather than left open.

The audit committee relationship

The CISO and the security function have a specific relationship with the audit committee — which is frequently the most consequential governance forum for security:

• Direct access. The CISO should have direct access to the audit committee — either through regular reporting or through the ability to request a session.
• Independent reporting. Where the CISO's view differs from management's, the audit committee provides the forum in which the difference can be aired.
• Findings context. The CISO provides context on audit findings — explaining the risk, the constraints, and the remediation approach.
• Risk acceptance. Where findings are accepted rather than remediated, the CISO supports the risk acceptance decision — with a clear statement of the risk.
• Collaboration with internal audit. The CISO and the chief audit executive work together — coordinating audit coverage with the security risk assessment, and sharing findings.
• No surprises. The audit committee should not be surprised by a finding — where a significant weakness exists, the CISO should ensure that the committee is aware of it in advance.

Common friction points

Leveraging certification and attestation

Certification and attestation can significantly reduce the audit burden:

• ISO/IEC 27001 certification. Provides assurance to customers, partners, and regulators — frequently accepted in place of customer-specific assessment.
• SOC 2 reports. Widely accepted by enterprise customers — reducing the need for customer-specific audit.
• Certification reduces duplication. One certification audit can satisfy multiple customer and regulatory requirements.
• Certification requires maintenance. Surveillance audits maintain the certification — but also require continuing effort.
• Certification is not security. As examined in Lesson 6.4 — certification demonstrates conformity with a standard, which is not the same as managing risk.
• Certification supports but does not replace internal audit. Internal audit provides assurance to the board; certification provides assurance to external parties. Both are necessary.

12 Common pitfalls

Cybersecurity audit programmes fail in predictable ways. Recognising the pitfalls accelerates improvement.

Pitfall 1 — No independent assurance

Operating without independent audit — so that the board's assurance about security comes entirely from the people whose performance it is assessing.

Mitigation: Establish internal audit with appropriate independence. Ensure it covers cyber risk. Provide board access. Engage external assurance where required.

Pitfall 2 — Compromised audit independence

Internal audit reporting to the CIO or to the security function whose controls it must assess — so that its objectivity is compromised.

Mitigation: Functional reporting to the audit committee; administrative reporting to the CEO. Document independence safeguards. Confirm independence annually.

Pitfall 3 — Audit plan not risk-based

Auditing the same areas on a rotation rather than directing effort based on risk — so that the areas of greatest exposure may not be audited.

Mitigation: Build the plan from the risk assessment. Document the rationale for prioritisation. Review the plan annually and adjust for changes in risk.

Pitfall 4 — Findings closed without remediation

Marking findings as closed without evidence that the underlying issue was addressed — so that the finding recurs in the next audit.

Mitigation: Verify remediation before closing. Require evidence. Where verification is not possible, document why and monitor the control.

Pitfall 5 — Recurring findings

The same findings appearing year after year — indicating that remediation has not addressed the root cause and that the finding process lacks consequence.

Mitigation: Perform root cause analysis. Escalate recurring findings to the audit committee. Address systemic issues. Where remediation is not possible, formal risk acceptance.

Pitfall 6 — Findings accumulate without action

A growing register of open findings — with no remediation progress and no consequence for the owners.

Mitigation: Define remediation timeframes by severity. Track to closure. Escalate overdue findings. Report the findings register to the audit committee.

Pitfall 7 — Risk acceptance is informal

Findings that cannot be remediated are closed without a formal acceptance decision — so no one is accountable for the residual risk.

Mitigation: Require formal risk acceptance, at a level proportionate to the severity of the finding. Document the acceptance, review it periodically, and report it to the audit committee.

Pitfall 8 — Audit treated as an exam

Management prepares for the audit rather than operating the controls — producing accurate findings for the period under review and no sustained improvement.

Mitigation: Operate controls consistently, not for the audit. Design controls to produce evidence as part of normal operation. Use continuous monitoring and continuous auditing to provide assurance between engagements.

Pitfall 9 — Findings contested rather than addressed

Management disputes findings rather than remediating the issues — producing adversarial relationships and concealing the underlying problem.

Mitigation: Engage with findings constructively. Where the finding is correct, accept it and remediate. Where the finding is contested, dispute with evidence. Focus on the risk, not on the attribution.

Pitfall 10 — Audit scope narrow and static

The same systems and processes audited each year, while emerging risk areas — cloud, OT, third-party, AI — are never examined.

Mitigation: Review the audit universe regularly. Include emerging risk areas in the audit plan. Use specialist skills where required. Rotate coverage.

Pitfall 11 — Audit decoupled from risk management

The audit plan is not informed by the risk register, and the risk register is not informed by audit findings — so the two operate independently.

Mitigation: Integrate audit planning with risk management. Feed findings into the risk register. Use the risk register to inform audit priorities.

Pitfall 12 — Root cause not addressed

Findings are remediated individually while the underlying condition that produced them persists — producing a new finding the following year.

Mitigation: Perform root cause analysis for every finding. Address the cause, not only the symptom. Analyse patterns across findings to identify systemic issues.

Pitfall 13 — Audit findings not reported to governance

Findings that are not reported beyond the audited function — so that the board has no visibility of the enterprise's control weaknesses.

Mitigation: Report findings to the audit committee. Provide aggregate reporting on the findings register. Report critical and high findings individually. Report trends.

Pitfall 14 — Audit resource and skills gaps

The audit function lacks the technical expertise to assess complex technology areas — so the audit is superficial or is outsourced without adequate oversight.

Mitigation: Invest in audit skills — training, recruitment, and where necessary, specialist co-sourcing. Ensure the audit function has access to technical expertise appropriate to the areas it audits.

13 Key concepts

The terms below are used throughout Unit 6. Capture them in your own words as you work through the lesson.

Audit

Independent, structured, evidence-based assessment of whether controls are designed appropriately and operating effectively — producing an opinion and findings for governance.

Internal audit

The enterprise's own independent assurance function — reporting to the audit committee, covering the whole enterprise, and operating to professional standards.

External audit

Independent audit performed by a firm external to the enterprise — providing assurance to shareholders, regulators, or customers.

Assurance

The confidence provided that controls are designed and operating effectively — from audit, from assessment, from certification, or from regulatory examination.

Audit universe

The complete set of auditable entities, processes, systems, and activities within the enterprise — the basis for audit planning.

Audit risk

The risk that a material control weakness exists and would not be detected without audit — assessed across inherent risk, control risk, detection risk, change, and other dimensions.

Risk-based audit planning

Deriving the audit plan from the enterprise risk assessment — directing audit effort toward the areas of greatest risk.

Engagement plan

The plan for an individual audit engagement — objectives, scope, criteria, risks, procedures, resources, timing, and reporting.

Audit criteria

The policy, standard, regulation, or control framework against which the area under review is assessed.

Audit procedure

A specific technique used to gather evidence — inspection, observation, inquiry, confirmation, re-performance, recalculation, analytical procedures, sampling, walkthrough, or data analysis.

Design effectiveness

Whether a control is designed to address the risk it is intended to mitigate.

Operating effectiveness

Whether a control operated as designed throughout the period under review.

Audit evidence

Information collected to support audit conclusions — which must be sufficient, reliable, relevant, useful, timely, and documented.

Audit finding

A documented conclusion that a control weakness exists — comprising condition, criteria, cause, effect, recommendation, and rating.

Condition

The component of an audit finding that states what was observed — factually, without judgement.

Criteria

The component of an audit finding that states what was required — the policy, standard, regulation, or control objective.

Cause

The component of an audit finding that states why the condition occurred — determined through root cause analysis.

Effect

The component of an audit finding that states the risk or consequence created by the condition.

Recommendation

The component of an audit finding that states what should be done — specific, actionable, and proportionate.

Root cause analysis

Determining why a finding occurred — the underlying condition that produced it — so that remediation addresses the cause rather than the symptom.

Finding rating

The severity assigned to a finding — critical, high, medium, low, or an equivalent scale — determining the expected remediation timeframe.

Management response

Management's formal response to an audit finding — acceptance or documented disagreement, with a remediation plan where remediation is pursued.

Remediation plan

The actions management will take to address a finding — with a named owner, a target date, and interim measures where necessary.

Follow-up

The process through which audit findings are tracked to closure — with verification of remediation and escalation where remediation is delayed.

Verification

Independent confirmation that remediation has occurred and that the finding has been addressed — not acceptance of management's assertion.

Recurring finding

A finding that appears in multiple audits — indicating that remediation has not addressed the root cause and that the finding process lacks consequence.

Risk acceptance (audit)

A formal, documented decision to retain a risk identified by audit rather than remediate it — approved at a level proportionate to the severity of the finding.

Audit committee

The board committee responsible for overseeing internal audit, external audit, financial reporting, and risk management — the forum in which audit findings acquire consequence.

Three lines model

The allocation of assurance roles: management owns and manages risk; risk and compliance functions provide expertise and challenge; internal audit provides independent assurance to the board.

IIA Standards

The Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing — governing independence, competence, planning, evidence, and reporting.

ISACA ITAF

The IS Audit and Assurance Standards Framework — standards, guidelines, and tools for auditing information systems and technology.

ISO 19011

Guidelines for auditing management systems — the reference for auditing against ISO management system standards.

ISAE 3402 / SSAE 18

The international and US standards for assurance reports on controls at a service organisation — governing SOC 1 and SOC 2 reports.

Certification audit

Assessment of conformity with a standard — ISO/IEC 27001, ISO/IEC 22301 — by an accredited certification body, producing certification where conformity is demonstrated.

SOC 2

System and Organization Controls 2 — an attestation report issued by an independent CPA firm on controls relevant to security, availability, processing integrity, confidentiality, and privacy.

Continuous auditing

Continuous or near-continuous testing of controls through automated analysis — complementing periodic audit and increasing coverage.

14 Activities

The activities below help you test your understanding and prepare for the unit discussion and Assignment 3. They are not graded, but completing them will substantially improve your preparation.

15 Self-check

Answer the questions below before moving to Lesson 6.7. If you cannot answer a question confidently, revisit the corresponding section.

16 Summary

This lesson has examined cybersecurity auditing — the discipline through which the enterprise verifies that its controls are designed appropriately and operating effectively. The essential points are:

• Auditing tests belief against reality. Every enterprise believes its controls are working; audit determines whether they actually are. The gap between belief and reality is where incidents occur.
• Audit is independent; assessment is not. Audit produces an opinion on which the board can rely; assessment produces information for management. The distinction determines whether the assurance is objective.
• The assurance landscape includes multiple providers. Internal audit, external audit, certification bodies, regulators, and third parties — each answering a different question for a different audience, and each requiring coordination.
• Audit practice is governed by professional standards. The IIA standards, ISACA ITAF, ISO 19011, ISAE 3402 / SSAE 18, and other standards define independence, competence, evidence, and reporting.
• Audit planning is risk-based. The audit universe is defined; audit risk is assessed; the plan is derived from the risk assessment. Every plan is a statement of priority — and of what will not be audited.
• The audit process is structured. Planning, opening meeting, fieldwork, findings development, reporting, closing meeting, follow-up, and closure — each stage existing to make the conclusion defensible.
• Audit evidence must be sufficient, reliable, and relevant. Evidence quality determines the reliability of the finding. Controls that generate evidence as part of normal operation are demonstrable; those that do not are not.
• The finding is the unit of output. Condition, criteria, cause, effect, and recommendation — with root cause analysis as the most valuable component, because addressing the cause prevents recurrence.
• Remediation determines value. An audit that produces findings without remediation has achieved documentation, not assurance. Verification, escalation, and formal risk acceptance are what make audit consequential.
• Follow-up and continuous improvement close the loop. Findings tracked to closure, verified, and fed back into risk management and audit planning. Continuous auditing extends coverage through automation.
• Working with auditors is a skill. Preparation, transparency, responsiveness, and constructive engagement with findings determine whether the engagement produces improvement or friction.
• Common pitfalls recur. No independent assurance; compromised independence; audit plan not risk-based; findings closed without remediation; recurring findings; findings accumulating without action; informal risk acceptance; audit treated as an exam; findings contested rather than addressed; narrow and static scope; audit decoupled from risk management; root cause not addressed; findings not reported to governance; audit resource and skills gaps.

These ideas prepare for the remainder of Unit 6. Lesson 6.7 examines incident response planning — a control area that is frequently the subject of audit findings. Lesson 6.8 examines business continuity and disaster recovery. Lesson 6.9 examines cyber resilience and enterprise recovery. Lesson 6.10 examines emerging trends, including continuous auditing and automated assurance.