EDUCATION, AUDIT, ASSURANCE

📋 Audit guide - international practice

Six basic questions about the audit - how it happens, who is responsible for what and what standards he works for (ISO 19011, IIA, COBIT, SOC, NIST). Examples are fictional, designed for training.

Audit Life Cycle

ISO 19011:2018 - Audit activities with continuous improvement loop

Audit process Five stages of audit: planning, preparation, performance, report, follow-up - with feedback loop. Audit process - ISO 19011:2018 Risk-based programme with PDCA continuous improvement loop 1. Planning audit programme (risk-based) objectives, scope 2. Preparation review of documents audit plan checklists 3. Success opening meeting evidence, interviews findings Report conclusions opinion final meeting 5. Following corrective actions verification closure √ continuous improvement (PDCA) ISO 19011:2018 (Programme 5, Chapter 6 Audit Activities), IIA Global Internal Audit Standards 2024. Risk-based approach: an audit programme and sample shall be planned after a risk assessment, not by chance. For NIS2 subjects compliance audit is a periodic, not a one-off event.

In practice

Suitable for any audit - both ISO 27001, quality and NIS2 compliance check. How to plan many audits in the annual cycle - audit programme.

Reference

ISO 19011:2018 (Guidelines for auditing management systems), IIA Global Internal Audit Standards 2024.

Safety Note

First check where the risk is greatest. Every finding must be proof - not just a conversation.

Audit programme - ISO 19011:2018 5.2-5.7

Six steps that repeat each year

Audit programme cycle Targets, risks, creation, implementation, monitoring and review in sequence, the outcome of the review returns to the objectives in the next cycle. PLAN - 5.2-5.4DO - 5.5CHECK - 5.6ACT - 5.7 5.2 Objectiveswhat the program gives 5.3 Risksand opportunities 5.4 Establishmentroles, competences,volume, resources 5.5 Implementationaudits by schedule 5.6 Monitoringperformance, indicators 5.7 Reviewand improvement lessons learned from the review changes the objectives of the following year

5.3 Risks

Programme Risks: lack of competent auditors, unrealistic timetables, not available for audits.

5.5 Implementation

For each audit: goals, volume, criteria, method, team. Results and records in the program.

5.7 Review

Did the programme achieve its objectives? If not, change the plan, not just next year's dates.

Audit programme - prioritisation

More frequent audit of where the risk is higher and testing long

Risk-time matrix for audit frequency Rows - risk level, columns - time since last audit. High risk and long-audited means auditing now. < 1 yearover 1 and up to 2 years> 2 years time since last audit High riskMedium riskLow risk this year now now next year this year now at 3 years next year this year

The risk level comes from a risk assessment (ISO/IEC 27001 6.1), not from an assumption. All areas of ISMS should be covered in the certification cycle.

QuarterScope (example)Annex A to ISO/IEC 27001:2022
Q1Access management5.15-5.18
Q2Security of suppliers5.19-5.23
Q3Incidents and Continuity5.24-5.30
Q4Backup and Logs, Management Report8.13, 8.15

Who is responsible for what

Auditor should not audit his work

Roles of the audit programme Supreme Management approves the program, the program manager manages it, auditors carry out audits, auditees provide evidence. The results return to the management. Senior managementconfirms, receives results Programme Managerplan, resources, monitoring Auditorscompetent, independent Auditsevidence, adjustments results and corrective actions - back to control

ISO/IEC 27001 9.2.2

The auditors shall be selected and audited in such a way as to be objective.

IIA GAS 2024

principle 9: strategic planning: the internal audit plan is risk-based and coordinated with the board.

Small organisation

In the absence of an independent auditor, the audit may be carried out by a colleague from another department or external specialist.

Roles of governance and confidence

IIA Three Lines Model 2020

Three Lines Model Administrative body, management (lines 1 and 2), internal audit (line 3) and external confidence. Three Lines Model - IIA2020 Previously, The Lines of Defense, the division of roles in risk management and confidence organisation Administrative body/Council monitoring, responsibility to stakeholders line 1 operational roles manage the risk on a daily basis products, services, IT operations line 2 risk, compliance, safety function (expertise) CISO, DPO, compliance, QA Line 3, Internal audit independent and impartial assurance + advice External confidence outside organisations - external audit - certifying authority - supervisory authority relies on line 3 work where possible MANAGEMENT ↑ independent reporting to the board

In practice

Shows who is responsible: Line 1 does work, Line 2 monitors, Line 3 (audit) independently checks.

Reference

IIA Three Lines Model (2020, above: "Three Lines of Defense"), COSO ERM framework.

Safety Note

Internal audit should not test your own work. Functionally, it reports to the board, can be administratively reported to the management - its management cannot influence the assessment.

Classification of audit parties

Types of audit - Sides 1, 2 and 3

The "Party' determines who performs the audit in relation to what is audited (ISO 19011). The 1st half audit itself, the 2nd half - someone who has an interest in the audit, the 3rd half - an independent body that has no interest on either side. The further the auditor stands out of the auditable, the more independent the rating is.

Types of audit by what is audited
HalfAuditingAudited byWhyExample
side 1internal auditAuditingorganisation itself - internal auditor or teamAudited bytheir units and processesWhyfind shortcomings and improve before others find themExampleannual Internal ISMS Audit (ISO 27001 9.2)
side 2supplier's auditAuditingclient or client with an interest in the resultAudited bytheir supplier or partnerWhyverify that the supplier complies with the contract and safety requirementsExamplebank checks its IT service provider (NIS2 Article 21 (2) (d) - supply chain)
side 3independent auditAuditingaccredited certification body or supervisor with no interest in the outcomeAudited byorganisation against standard or requirementsWhydemonstrate compliance with other - customers, monitor, marketExampleISO 27001 certification audit
  1. 1. side 1the auditor is an employee of the same organisation
  2. 2. side 1the auditor is from another organisation, but with his or her interest
  3. 3. side 1the auditor is not related to any side - independence the greatest

In practice

Helps to understand how independent the auditor is and why the audit takes place - for its own improvement, supplier's inspection or certificate.

Reference

ISO 19011:2018 (3.1 audit parties), ISO/IEC 17021-1, ISO/IEC 27006-1:2024.

Safety Note

The ISO 27001 certificate can only be issued by an independent (3rd party) authority. The customer checks its suppliers - it is a 2nd party audit (important for the NIS2 supply chain).

Audit programme - ISO 19011 5.6

The program shall be measured after completion and after closure of the finds

IndicatorCalculationWhat is shown
Implementation of the planperformed/planned auditswhether the graph is realistic
Closed-out findingsclosed due date/all findingsor audit changes something
Repeated findingssame findings as in previous auditwhether adjustments eliminate the cause
Average closing timedays from report to closurereaction rate

Records

Programme, annual plan, each audit plan and report, corrective actions, evidence of competence of auditors.

ISO/IEC 27001 9.2.2

Documented information as proof of programme implementation and audit results.

Map of international auditing standards

Standard landscape after audit objective

Audit standards landscape Eight groups of audit standards by domain: methodology, ISMS, IT management, service organisations, controls, internal audit, financial, EU regulation. Audit standards landscape Choose a standard by audit purpose - they often overlap Methodology ISO 19011:2018 audit of management systems ISO/IEC 17021-1 certification bodies ISMS certification ISO/IEC 27001:2022 requirements (annex A) ISO/IEC 2706-1, 27007 audit guidelines IT management COBIT 2019 ISACA, IT governance ITIL 4 service management Service organisations SOC 1 / 2 / 3 AICPA Trust Services ISAE 3402 international insurance Evaluation of controls NIST SP 800-53A evaluation of controls NIST CSF 2.0 risk framework Internal audit IIA Global Standards 2024 (part of IPPF) Three Lines Model allocation of roles Financial/assurance ISA (IAASB) intermediate audit standards PCAOB U.S. Public Comp. EU framework NIS2, DORA cyber security, finance DGPR data protection audit SOC 2 (Trust Services) and ISO 27001 both check information security controls but differ in format and opinion

In practice

Helps to choose the right standard by what you want to achieve - certificate, better IT management or compliance with the law.

Reference

ISO, ISACA (COBIT), AICPA (SOC), IAASB (ISA), IIA, NIST, EU Regulations (NIS2, GDPR, DORA).

Safety Note

Standards overlap. One good ISO 27001 often also covers a large part of SOC 2 and NIS2. Put the controls together to avoid doing one job twice.

Audit evidence and sample

Sufficient + relevant evidence, confidence hierarchy

Audit evidence and sample Evidence of reliability of pyramid and obtaining techniques (examine, interview, test). Audit evidence Sufficient (quantity) + appropriate (relevance + reliability) Confidence hierarchy ↑ re-performance external sources internal documents, windows oral statements top = more reliable, bottom = weaker Generation techniques (NIST SP 800-53A) Examine policies, configurations, magazines Interview personnel, process owners Test control activity, re-performance Sampling statistical vs assessment (judgmental) volume by risk and population ISO 19011:2018 (6.4.7, A.6), NIST SP 800-53A, ISA 500 (evidence), ISA 530 (sample) Exports and rechecks of windows and configurations are more reliable than words

In practice

The conclusions should be based on evidence, not mentioned. The sample shall examine a part and conclude on the whole.

Reference

ISO 19011:2018 (6.4.7 Information gathering, A.6 sample), NIST SP 800-53A (Examine / Interview / Test), ISA 500, ISA 530.

Safety Note

System exports and re-examination are more reliable than human story. Ask for evidence that the auditee cannot easily adapt.

Technical evidence from a server

Re-performance in practice: run the commands yourself and save the output with the date. All of them only read. The full lists are in the Linux and Windows system audit.

Services

  • Running services
    systemctl list-units --type=service --state=running --no-pager

    What to look for: Every service should have a known purpose and owner. A service nobody can explain is unnecessary attack surface - record it in the report and agree on disabling it with the system owner.

  • Failed services
    systemctl --failed --no-pagersystemctl is-system-running

    What to look for: The answer degraded means at least one service failed to start. A failed security service (firewall, logging, backups) is a finding even if the system otherwise works.

  • One service's state and log
    systemctl status <serviss> --no-pagersudo journalctl -u <serviss> --since "24 hours ago" --no-pager

    What to look for: Whether the service is enabled and active, how often it restarted and what errors it logs. Frequent restarts hide a crash users have not noticed yet.

  • Which service holds a port
    sudo ss -tlpn 'sport = :<ports>'systemctl status <PID> --no-pager

    What to look for: The first command gives the process PID, the second the service it belongs to. A port with no service (a process started by hand or from cron) must be explained.

  • Service sandboxing
    systemd-analyze security --no-pagersystemd-analyze security <serviss> --no-pager

    What to look for: A score from 0 (sandboxed) to 10 (no restrictions). For a network service rated UNSAFE, recommend restrictions such as NoNewPrivileges and ProtectSystem. It is a recommendation, not an error.

Network exposure

  • Listening ports
    sudo ss -tulpn

    What to look for: Every port should belong to a known service. Address 0.0.0.0 or [::] means the service is reachable from the network. A database or an admin panel should usually listen on 127.0.0.1 only.

  • Established connections
    sudo ss -tnp state established

    What to look for: Connections to unknown external addresses, especially from processes that have no reason to talk to the internet.

  • Firewall rules
    sudo nft list rulesetsudo iptables -S

    What to look for: The default policy for incoming traffic should be drop or deny. A rule that allows everything without restriction overrides the rest.

  • The ufw firewall and open ports
    sudo ufw status verbosesudo ufw status numberedsudo ufw show listening

    What to look for: The first line says whether ufw is active at all, and the default for incoming should be deny. show listening puts the listening ports next to the rules: a port without an allow rule is not reachable from the network, and a rule without a service is unnecessary.

  • Ports published by containers
    docker ps --format 'table {{.Names}}\t{{.Ports}}'sudo iptables -S DOCKER-USER

    What to look for: Docker forwards published ports before the ufw rules, so ufw status neither shows nor blocks them. 0.0.0.0:5432->5432 means the database is open to the network regardless of ufw. Restrictions for containers belong in the DOCKER-USER chain.

Classification and opinion of findings

Non-compliance (ISO) and audit findings (ISA / SOC)

Findings and Opinion ISO classification of non-compliances and types of assurance opinions. Findings and audit opinion ISO classification of findings "Conformity" control meets the requirement and works √ Minor NC (not relevant) individual deviation → corrective action plan √ Major NC (essential) systemic failure → certificate blocked i Observation / OFI improvement option (no non-compliance) ISO/IEC 17021-1, ISO 19011 Types of assurance opinion Unqualified / Unmodified clean opinion - effective controls Qualified ( separate significant reservation, other arrangements Address (negative) significant and widespread non-compliances Disclair (Renunciation) insufficient evidence → no opinion ISA 700–705 (IAASB), AICPA SOC Major NC = systemic control failure → certificate cannot be issued/maintained until resolved and verified. The certification audit shall give a conformity decision. The assurance audit (SOC, ISA) gives an opinion on the effectiveness of controls. NIS2 penalties: for significant entities up to EUR 10 M or 2%, for significant up to EUR 7 M or 1,4% of turnover.

Structure of the finding - five elements

ElementQuestionExample
CriterionWhat?Access rights shall be reviewed quarterly (ISO/IEC 27001 A.5.18).
StateWhat?no review within 12 months. 7 out of 40 accounts belong to outgoing employees.
CauseWhy?The responsible staff member does not report an IT departure.
EffectsWhat's the risk?A former staff member may access client data.
RecommendationWhat must we do?Determine responsible, automate departure notification, block 7 accounts immediately.

A finding without cause gives advice to correct the symptom. Without the consequences, management cannot decide on priority. IIA Global Internal Audit Standards 2024, principle 14.

In practice

Dissociates findings by severity and formulates an opinion. It depends on whether the certificate is issued and how much confidence the audit gives.

Reference

ISO/IEC 17021-1 (NC classification), ISA 700 9.3.2005705 (audit opinions), AICPA SOC reports.

Safety Note

Major NC means that control does not work seriously. The certificate shall not be issued until it has been corrected and verified.

Abbreviations

Abbreviations used in the Roadmap: the original name and what it means.

IIA
Institute of Internal Auditors - Institute of Internal Auditors; issue GIAS standards.
GIAS
Global Internal Audit Standards - IIA internal audit standards (2024).
ISACA / COBIT
IT Management Association and its IT management framework.
COSO / ERM
Committee of Sponsoring Organizations / Enterprise Risk Management - the framework for internal control and corporate risk management.
SOC 1 / 2 / 3
System and Organization Controls - auditor's opinions on the controls of the service provider.
ISA
International Standards on Auditing - international auditing standards (IASB).
ISAE
International Standard on Assurance Engagements - standards for assurance tasks (e.g. ISAE 3402).
IAASB
International Auditing and Assurance Standards Board - the Board issuing ISA and ISAE.
PCAOB
Public Company Accounting Oversight Board - U.S. Stock Exchange Audit Officer.
ISMS
Information Security Management System - information security management system (ISO 27001).
PDCA
Plan-Do-Check-Act - plans - do - check - improves.
NC / OFI
Nonconformity / Opportunity for Improvement - non-compliance/improvement possibility in the audit report.
CISO / DPO
Chief Information Security Officer / Data Protection Officer - information security manager / data protection officer.
ITIL
Good practice in IT service management.
DORA
Digital Operational Resilience Act - the EU Financial Sector Digital Sustainability Regulation.