Capstone: Run an Integrated Audit

What you'll be able to do

• ›Plan a combined audit while preserving four distinct assurance boundaries
• ›Select and test risk-led samples using traceable evidence
• ›Grade findings and write a decision-ready integrated audit summary
• ›Verify corrective action effectiveness before closing findings

Accept the integrated engagement

Corrective action (CA) labels exercise records. Observation one (O01) is an observation identifier. Finding two (F02) is a finding identifier. Finding one (F01) is a finding identifier. Hosting change seven (H07) is a ticket identifier. Emergency change twelve (E12) is a ticket identifier. Emergency change one (E01) is a ticket identifier. Data Security Standard (DSS). A cafe may pass a food inspection and a fire inspection. One visit does not make those two approvals interchangeable. You lead an internal combined audit at fictional Tern Quay Payments and Hosting. Its 80 staff run a hosted checkout platform, a cardholder data environment (CDE), and managed hosting. The company holds certificates for International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 27001:2022, ISO/IEC 20000-1:2018 and ISO 22301:2019 within their documented boundaries. Also, Has a Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 assessment for its payment service. These are separate assurance claims: a shared audit visit cannot expand a certificate or replace a required PCI assessment.

The audit committee requests an independent internal audit of January through March 2026, with fieldwork on 13 and 14 April. The objective is to determine whether shared change, access, incident and recovery processes satisfy applicable criteria and operate effectively across the payment and hosting services. Obtain the actual certificate scopes, PCI assessment boundary, service catalogue, contracts and data flows before agreeing coverage. The CDE includes checkout production and its administrative jump host. Payroll is outside scope and has no service interface in this case.

The lead auditor has no operational responsibility. A payments specialist tests CDE requirements, a service-management auditor examines service delivery, and a continuity auditor evaluates recovery. Management owns fixes and risk decisions. Record conflicts and use a different competent auditor for any process the original auditor designed or operated. Agree secure evidence access, daily checkpoints, escalation to the audit committee, and a report date of 20 April.

Map criteria without losing boundaries

One receipt may support both a refund claim and an expense record. It still needs to meet each set of rules. Build a matrix whose rows are processes and whose columns distinguish requirements, applicable assets, evidence and responsible auditor. Shared management-system work can cover documented information, internal audit, management review and corrective action. Relevant references include ISO 27001 clauses 9.2 and 10.2, ISO 20000-1 clauses 9.2 and 10.1, and ISO 22301 clauses 9.2 and 10.1. Check applicable editions and the company controls rather than treating similar clause numbers as identical text.

For change control, map ISO 27001 Annex A 8.32 where applicable through the Statement of Applicability, ISO 20000-1 clause 8.5.1, and PCI DSS requirement 6.5. For recovery, map ISO 22301 clauses 8.4 and 8.5, ISO 20000-1 clause 8.7.2 and applicable ISO 27001 controls such as Annex A 8.13 and 8.14. PCI-specific tests still need their own scope and evidence. A hosting change with no CDE effect does not establish PCI compliance.

Follow one production change through request, security impact, approval, deployment, monitoring and recovery implications. Reuse its evidence where it genuinely supports multiple criteria, but record separate conclusions. A missing approval may breach more than one applicable criterion and still be one linked finding. Conversely, a recovery exercise cannot prove the effectiveness of every change control. Note uncovered criteria and assign additional testing rather than declaring everything integrated.

Plan risk-led sampling

When checking a fruit delivery, do not inspect only the neatest boxes. Choose items based on the problems you need to detect. The verified change export contains 120 closed changes in the period: 12 emergency CDE, 48 normal CDE and 60 hosting-only changes. Reconcile that export to deployment records and change identifiers before selecting a sample. Management offers six tidy tickets. Reject convenience selection as the sole basis. Your agreed minimum is 18: all 12 emergency CDE changes, three normal CDE changes and three hosting-only changes. The auditor selects these across January, February and March.

This is a targeted, nonstatistical sample driven by emergency access and payment exposure, not a random sample yielding a confidence percentage. Document the population query, export timestamp, exclusions, selected identifiers, selection rationale and untested remainder. Keep original evidence in a restricted repository and put sanitized identifiers in working papers. Never copy live payment data into a learning or reporting tool.

Fieldwork day one covers scope confirmation, population reconciliation and change tests. Day two covers incidents, restoration evidence, recovery exercises, management-system records and the closing meeting. Discovery of an unexplained exception triggers expansion into the affected stratum and periods. If logs or personnel remain unavailable, record a scope limitation, seek alternatives. Also, Escalate its impact on assurance instead of treating missing access as proof of conformity.

Test design and operation

A recipe shows how a meal should be made. Watching the cooking and checking records show what actually happened. For each selected change, first test whether the procedure defines independent approval, impact analysis, emergency authorization and post-change review. Then inspect time-stamped tickets, identities and deployment logs to test actual operation. Interview the change owner to understand contradictions, but do not substitute a verbal assurance for missing execution records. Compare approval time with deployment time and confirm the approver is not the implementer.

All 12 emergency CDE changes lack required retrospective review and the workflow has no review gate. The payment specialist confirms the company procedure requires review within two business days, supported by applicable PCI DSS 6.5 controls and ISO 20000-1 8.5.1. Preserve ticket identifiers E01 through E12, the first and twelfth emergency changes, workflow version and interview confirmation. Expand to the full emergency workflow configuration and verify this is a process-level absence, not a single late signature.

Hosting ticket H07, the seventh hosting change, has one missing independent approval among otherwise supported normal-change tests. Approval gates exist, other sampled approvals are timely, and deployment logs show no related service failure. Record the exception without inferring the entire system failed. A recovery exercise achieved the documented four-hour recovery objective and fifteen-minute recovery point objective, but its contact-list presentation is awkward. Appearance alone does not prove a requirement was breached.

Grade findings against explicit rules

A single missing receipt differs from a shop having no receipt process. Findings should reflect the kind of failure the evidence shows. Use the internal audit programme grading convention agreed for this engagement. Major means a systemic absence or breakdown that materially undermines intended outcomes. Minor means an isolated failure against a requirement without evidence of systemic breakdown. Observation means a supported improvement opportunity with no demonstrated nonconformity, a failure to meet a requirement,. These labels are this programme convention, not a claim that every framework uses identical grading. PCI assessment reporting still follows its own required method.

Finding F01 is major: the emergency CDE review process is absent across all 12 cases and the configured workflow. Link objective evidence to the internal two-business-day rule and applicable change requirements. Explain the risk of unreviewed payment changes without claiming a breach occurred. Finding F02 is minor: H07 violates the independent-approval procedure, while other tests and existing gates support an isolated failure. Severity is not determined simply by counting mapped standards.

Observation O01 remains an observation. The valid continuity exercise met its objectives and verified participants. Grouping the contact roster by recovery role would aid navigation. No required contact is missing. Do not disguise a real failure as an observation to avoid confrontation, and do not turn a preference into a requirement. Validate facts with owners. The audit lead retains the evidence-based grade and documents disagreements.

Write a decision-ready report

A repair summary should tell the owner what failed, why it matters, and what needs action. An audit report has the same practical purpose. The report identifies objective, scope, period, criteria editions, team, methods and limitations before stating conclusions. Separate the three management-system scopes from the PCI assessment boundary and say explicitly that this internal report grants no certification or PCI attestation. Include sample denominators: 18 of 120 changes, comprising 12 of 12 emergency CDE, three of 48 normal CDE and three of 60 hosting-only changes. Describe targeted selection and do not extrapolate a statistical defect rate.

A useful executive conclusion states that emergency CDE change review is not effective and requires urgent management action. Sampled normal-change operation has one isolated approval failure. Continuity evidence supports the tested recovery objectives, not a guarantee of future availability. Overall assurance is qualified by targeted sampling and by any disclosed evidence-access limits. Identify positive evidence without allowing it to cancel a major finding.

For each finding provide identifier, criterion, condition, evidence, risk, grade, accountable owner and due date. F01 belongs to the payments operations director and is due 30 April 2026. F02 belongs to the hosting service manager and is due 7 May 2026. The service continuity lead may consider O01 at the next exercise. Management replies and action plans belong alongside the report, not in place of auditor conclusions. Agree escalation of overdue major actions to the audit committee.

Track correction and corrective action

Mopping up water fixes the puddle, while repairing the pipe prevents another one. Correction and corrective action address different needs. Correction addresses the detected problem, such as reviewing the 12 emergency changes or checking H07 approval impacts. Corrective action addresses why it happened and prevents recurrence: analyze why the workflow omitted the review gate, assign ownership, implement controlled configuration and train responders. A root cause of human error alone is not enough when the system allowed the omission throughout the period.

The action register records each finding, grade, root cause, correction, systemic action, owner, deadline, evidence links, verification criteria and status. A management signature confirms commitment but cannot establish operating effectiveness. For F01, require retrospective review of E01 through E12 and a controlled gate release. Require independently checked reviews of five subsequent emergency CDE changes within two business days. This five-change criterion is a case-specific closure rule, not a universal standard requirement.

Keep a finding open if the fix is only planned, implemented but untested, or contradicted by a failed retest. Seek sufficient operation after deployment to judge sustainability and escalate overdue or failed major actions. Management may accept residual risk within its authority, but that does not make a missing requirement conformant or permit audit to close it as effective.

Verify closure and carry learning forward

A repaired pipe needs a fresh leak check. Closing a finding also needs evidence that the fix works. An auditor independent of the repair checks source evidence and reproduces the timeliness test. Trace action links back to the original finding, confirm the correction covers the original affected population and test the prevention measure on subsequent transactions. For F02, verify the H07 impact review, approval-gate repair and ten subsequent hosting changes with independent approvals before deployment. Close only the finding supported by its own criteria.

Review the closure pack in the final lab as separate claims. One claim contains only training attendance. Another proves a new gate exists but shows a later missed review. A third includes original corrections and all required successful retests. Reject unsupported closure even if a senior owner asks for it before the board meeting. Accepted evidence does not certify the entire company. It establishes closure against the defined finding and retest scope.

Issue a follow-up note recording the verifier, date, evidence references, retest results and remaining exposure. Update the audit programme to revisit emergency changes and service recovery at the next risk-based cycle. Report systemic lessons to management review, retain working papers under the evidence policy and carry unresolved scope limitations into planning. Integrated assurance saves repeated collection only when each conclusion remains traceable to its own criteria.