Audits and compliance assessments

An audit is the most formal kind of assessment. It asks whether an organization meets a defined set of criteria, it is performed by someone independent of the activity being examined, and it ends in an opinion or report that others rely on. Customers rely on a supplier's audit report instead of inspecting the supplier themselves; boards rely on internal audit to tell them whether management's controls work; regulators rely on certifications and attestations to decide where to focus. Sub-domain 6.5 of the outline, conduct or facilitate security audits, expects a security professional to understand the types of audit, plan for them, support auditors and act on their results.

This lesson explains internal, external and third-party audits, the main attestation and certification schemes a security manager meets, how an audit engagement runs, and how to prepare an organization so that audits are a confirmation of good practice rather than a scramble for evidence. Country maps cover the professional standards and government programs that differ between Canada and the United States.

Types of audit

Audits are often classified by who performs them and who relies on them. A first-party audit is an internal audit: the organization examines itself, usually through an internal audit function that reports to the board's audit committee to preserve independence from management. A second-party audit is performed by a customer or partner on a supplier, often under a right-to-audit clause in the contract. A third-party audit is performed by an independent external body, such as a certification body or a public accounting firm, and produces a report or certificate that many parties can rely on.

Independence is the thread that runs through all three. An auditor must not audit their own work or work they are responsible for, and should report to someone other than the people being audited. The Institute of Internal Auditors' Global Internal Audit Standards, which took effect in January 2025, require internal audit to be positioned so it can operate free from interference, with a functional reporting line to the board. The exam often tests this: when an option has the security team audit the controls it designed and runs, look for a more independent alternative.

Service organization reports

When an organization outsources a function, such as payroll, cloud hosting or customer support, it remains accountable for the controls around that function. Service organization control reports let the service provider demonstrate its controls once to many customers. The scheme is defined by professional accounting standards, and the reports come in types that the exam expects you to distinguish.

In the United States, the AICPA's attestation standards (SSAE 18 and later clarified standards) govern these reports. A SOC 1 report, under AT-C section 320, covers controls relevant to user entities' internal control over financial reporting and is used by customers' financial auditors, including for Sarbanes-Oxley compliance. A SOC 2 report covers controls relevant to security, availability, processing integrity, confidentiality and privacy, assessed against the Trust Services Criteria (2017, with points of focus revised in 2022). A SOC 3 report is a short, general-use summary of a SOC 2 engagement that can be published.

Reading a SOC 2 Type II report is a practical skill. Check the period covered and whether it is recent; the scope (which systems, locations and Trust Services categories); the auditor's opinion and whether it is qualified; any exceptions found in testing and management's responses; the subservice organizations, such as a cloud provider underneath the vendor, and whether they are included or carved out; and the complementary user entity controls, which are controls the vendor expects you, the customer, to operate. A vendor's report is not assurance for controls it assigns to you.

ISO/IEC 27001 certification

ISO/IEC 27001 specifies requirements for an information security management system (ISMS): a governed, risk-based system for managing security, with policies, risk assessment and treatment, a Statement of Applicability listing the Annex A controls and their status, internal audit, management review and continual improvement. The 2022 edition reorganized Annex A into 93 controls in four themes (organizational, people, physical and technological), and the transition period for certificates issued against the 2013 edition ended on 31 October 2025.

Certification is performed by a certification body accredited by a national accreditation body, which in Canada is typically the Standards Council of Canada and in the United States the ANSI National Accreditation Board (ANAB). The initial audit has two stages. Stage 1 reviews documentation and readiness, including the scope, the risk assessment and the Statement of Applicability. Stage 2 evaluates whether the ISMS is implemented and effective, through interviews, observation and evidence sampling. A certificate is valid for three years, with surveillance audits at least annually and a recertification audit before expiry. Nonconformities found in audits are classified as major or minor and must be corrected through documented corrective actions.

A certificate states that an ISMS meets the standard's requirements for a defined scope. It does not certify that every control is strong, and the scope may cover only part of an organization. When relying on a supplier's certificate, check the scope statement, the certification body and its accreditation, the issue and expiry dates, and ask for the Statement of Applicability to see which controls are included.

PCI DSS assessments

The Payment Card Industry Data Security Standard applies to organizations that store, process or transmit payment card data. Version 4.0.1, published in June 2024, is the current version; the requirements that were future-dated in version 4.0 became mandatory on 31 March 2025. Depending on transaction volume and the card brands' rules, an organization validates compliance either through an assessment by a Qualified Security Assessor (QSA), producing a Report on Compliance, or through a self-assessment questionnaire. Either way, an Attestation of Compliance summarizes the result.

PCI DSS contains some of the most specific testing requirements in any common framework, which makes it a good reference for what regular testing looks like in practice. Requirement 11 requires internal vulnerability scans at least every three months and after significant changes; external scans at least every three months by an Approved Scanning Vendor (ASV); internal and external penetration testing at least every 12 months and after significant changes, following a defined methodology; and testing of segmentation controls, at least every 12 months for merchants and every six months for service providers, if segmentation is used to reduce scope. Requirement 10 governs audit logging and log review.

Government cloud assessment programs

Governments assess cloud services before departments may use them for sensitive information, and these programs are often required of vendors that sell to the public sector.

In the United States, the Federal Risk and Authorization Management Program (FedRAMP) standardizes security assessment of cloud services used by federal agencies, with independent assessment by accredited third-party assessment organizations. In 2025 FedRAMP launched FedRAMP 20x to move from document-heavy reviews toward automated, continuously validated key security indicators. Industry reports from 2026 describe a consolidated 2026 rule set that renames authorization as certification and replaces the Low, Moderate and High baselines with classes, with transition deadlines running into 2027 and 2028 (as reported in October 2026; confirm the current rules at fedramp.gov before relying on them).

Financial reporting controls

Security controls also appear in audits of financial reporting, because financial systems depend on IT general controls: access to systems and data, change management, and operations such as backup and job scheduling. Weaknesses in these controls can undermine the reliability of financial statements, so auditors test them.

In the United States, section 404 of the Sarbanes-Oxley Act requires management of public companies to assess internal control over financial reporting, and section 404(b) requires the external auditor of larger companies to attest to it under PCAOB standards (AS 2201). IT general controls over financially significant systems are therefore tested every year, and deficiencies can be reported as significant deficiencies or material weaknesses.

Running an audit engagement

From the auditee's side, an audit follows a predictable path. Planning agrees the objectives, criteria, scope, period, timetable and evidence requests. Fieldwork collects evidence through interviews, document inspection, observation and testing. Findings are discussed with management as they arise so that facts can be confirmed. The draft report sets out findings, risk ratings and recommendations, and management adds responses with actions, owners and dates. The final report goes to the governing body. Follow-up confirms that actions were completed.

Good preparation means that evidence already exists because the controls are part of normal work: tickets for changes, records of access reviews, logs of backup restores. A central evidence repository, mapped to control frameworks, lets one set of evidence serve several audits. Many organizations use a common control framework that maps ISO/IEC 27001, SOC 2, PCI DSS and regulatory requirements to a single set of internal controls, so that each control is tested once and the result reused.