Loading page…
Assurance practice
Controls documented as effective and controls operating effectively are not the same thing. We test them, evidence the difference, and give management a clear view of where reliance is justified.
In this practice
+1 more service in this practice
What we usually find
Outcomes
Design effectiveness and operating effectiveness tested separately, with sampling and evidence recorded so conclusions can be re-examined.
Each finding rated, root-caused and assigned to a named owner with a management response and a committed date.
Internal audit run to the same rigour as the external audit, so the certification body finds little you did not already know.
A risk-based annual plan with a defined universe, coverage rationale and reporting line to the audit committee.
What we deliver
Scoped individually or combined into a programme, depending on where you are starting from.
Audit universe definition, risk-based annual planning, fieldwork execution, reporting and follow-up through to closure.
Testing of technical and administrative controls against ISO 27001 Annex A, NIST CSF, CIS Controls or your own control set.
Assessment of conformance against applicable regulatory, contractual and standard requirements, with gaps evidenced.
A full pre-certification audit conducted to the standard's own criteria, so Stage 2 holds no surprises.
Process-level review identifying control duplication, manual effort and handoffs that create risk or delay.
Assessment of supplier control environments against your contractual security and compliance requirements.
Deliverables
Named outputs, not a workstream description. Every item below is produced by this practice and can be reviewed in draft before it is finalised.
Auditable entities inventoried and rated, with a coverage plan showing what is audited, when, and on what risk basis.
Test procedures per control objective, with sampling approach and evidence requirements defined before fieldwork begins.
Complete working papers with review status, so every conclusion in the report can be traced to the evidence that supports it.
Findings with severity, root cause, business impact and management response, plus an opinion on control effectiveness over the period.
Agreed actions with owners and due dates, tracked through to verified closure rather than to management agreement.
Where certification is the objective, a readiness verdict against the standard with the specific items that would raise a major non-conformity.
Our approach
Each stage produces something you can review before the next one starts. No stage depends on trusting that the previous one went well.
Auditable entities, processes and systems, each mapped to the risks and obligations that make it worth auditing.
An annual plan that allocates audit effort by risk and regulatory pressure, approved by management or the audit committee.
Walkthroughs, sampling and testing, with workpapers recorded so every conclusion traces back to evidence.
Findings rated and discussed before issue, with root cause identified and a management response agreed rather than imposed.
An audit report for management and a summary suitable for the board or audit committee.
Corrective actions tracked to closure and verified, not signed off on assertion.
SecureGRC · technology enablement
SecureGRC carries the audit universe, plans, checklists, fieldwork, evidence, findings and corrective actions as connected records — so follow-up is a live queue rather than a spreadsheet someone maintains.
Relevant platform capabilities
Common questions
Related practices
Next step
Tell us your current position, what has to be demonstrated and the date it is required by. You will receive a scoped approach with defined stages — not a generic proposal.