Performing a Security Standard Audit, End to End

What you'll be able to do

• ›Define audit objectives, boundaries and criteria for a fictional production service
• ›Build a risk-based audit plan with defensible sampling and independent roles
• ›Corroborate interviews with documents and reproducible control tests
• ›Write and challenge evidence-based findings without overstating conclusions
• ›Verify corrective-action effectiveness before closing audit findings

Audit programme: choose the work before the visit

A landlord checks a leaking roof before repainting a sound wall. An audit programme also directs attention to important risks first. You are the independent internal audit lead at fictional Cedar Relay Cloud, a 70-person company operating a hosted scheduling service. Its production service holds customer contact details and dispatch instructions. A recent departure left a privileged account active, and a failed recovery exercise threatens contractual availability. This room follows one internal International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 27001:2022 audit from programme decision to verified closure, not a certification decision.

The annual audit programme coordinates several audits: objectives, frequency, methods, responsibilities, resources and reporting. Its owner considers process importance, organizational changes and previous audit results under clause 9.2. Give identity management and recovery earlier attention because of recent incidents. Do not audit only departments that are easy to schedule. Record why lower-risk areas receive less effort and ensure the programme still covers the management system over its planned cycle.

The audit committee approves resources and receives unfiltered results. Assign auditor Mira, who has not designed or operated the controls, and a read-only technical specialist. Verify their competence in the standard, interviewing and cloud evidence. A control owner may explain a process but must not independently audit their own work. Use ISO 19011 as guidance, not as a substitute for the actual audit criteria.

Objectives, scope and criteria

Before checking a bill, agree which purchases and price list are included. An audit needs equally clear boundaries and comparison rules. The objective is to determine whether access removal and recovery arrangements meet Cedar requirements and work in practice. Scope is production identity management and service recovery for January through March 2027. It includes remote operators, the personnel departure feed, the production cloud and its managed hosting interface. Payroll processing itself is outside scope, but its departure notifications are an in-scope dependency. Name the sites, teams, period and interfaces so exclusions do not hide the service risk.

Criteria include ISO/IEC 27001:2022 clauses 9.2 and 10.2 for the relevant audit and corrective-action processes. They also include Cedar identity and access management (IAM) policy IAM-04 version 3, requiring privileged access removal within 24 hours of departure. Also, recovery (REC) policy REC-02 version 2 requiring quarterly recovery exercises and recovery within four hours. Relevant selected controls in the Statement of Applicability provide context, including A.5.18 and A.8.13. Annex A is not automatically a universal checklist of mandatory implementations.

Agree objectives, scope and criteria with the audit sponsor and communicate them to process owners. This is a scoped internal audit, not assurance that every clause or every system conforms. If production logs become unavailable, document the limitation, assess the effect on the objective and agree a justified change rather than quietly narrowing the claim.

Turn risk into a practical audit plan

A trip needs a timetable, route, and enough time for delays. An individual audit also needs a practical plan. The individual audit plan translates the programme into a scheduled assignment. Plan a two-day remote audit on 12 and 13 April 2027. Include an opening meeting, controlled document review, and separate interviews with personnel operations and identity administrators. Schedule access testing, recovery observation, evidence consolidation and a closing meeting. Assign owners and realistic time windows, define secure evidence transfer and reserve time to expand testing.

Obtain a complete departure population by reconciling the personnel register with identity-system records. There are 40 departures in the period, including eight privileged users. Test all eight privileged departures because their impact is high, then select eight of the other 32 using a documented reproducible random method. This is a mixed risk-based sample, not a statistical estimate for the entire workforce. Record population snapshot, selection method and selected identifiers.

Compare departure timestamps with disable-event timestamps using a common time zone. Independently inspect the four quarterly recovery exercises due in the preceding year because the period-specific recovery criterion requires that wider lookback. Record that extension explicitly in the plan. Check actual restoration and elapsed time rather than accepting a completed calendar invitation. The first lab asks you to encode the plan, not to promise universal conformance.

Open the audit and review controlled documents

Before a repair starts, confirm the job and the instructions everyone will use. An opening meeting does the same for an audit. At the opening meeting, confirm purpose, scope, criteria, participants, timetable, communication routes and confidentiality. Explain sampling limitations, finding categories and escalation of urgent exposure. Ask the process owners to confirm evidence access and correct factual boundary errors. Keep minutes and attendance. A friendly opening is not permission for management to veto adverse results.

Request approved IAM-04 and REC-02 versions effective during the tested period. Also request the risk register, Statement of Applicability, previous audit findings, departure register, identity event exports and recovery reports. Build an evidence index with source owner, capture time, covered period, version and access restrictions. Use read-only exports stored in an approved restricted repository. Redact unrelated customer data and follow the retention schedule.

Document review establishes intended design and prepares test questions. A current policy cannot prove the policy effective three months earlier, and an approved procedure cannot prove operation. If a new version changes a deadline, use the version applicable when the sampled event occurred. Record missing evidence as a limitation to investigate rather than immediately accusing the owner of a control failure.

Interview for a traceable process

If someone says a parcel was delivered, ask to see the delivery record. A helpful explanation still needs supporting evidence. Ask personnel operations to walk through a real departure from notice to delivery of the disable request. Ask the identity administrator, separately, how the request reaches the queue, how overdue work is escalated and what happens out of hours. Start with open questions, then ask for a specific record. Do not lead with "you always disable within 24 hours, correct?" and record that answer as proof.

Cross-check statements with timestamps, queue entries, system events and the applicable requirement. The administrator says all privileged removals are automatic, but two records have manual disable events days later. Ask the owner to reconcile the discrepancy and inspect the automation coverage. A sincere interviewee can describe intended practice rather than actual behavior. Contradictory evidence requires further work, not a vote between witnesses.

Capture interview date, role, topic and evidence references without copying unnecessary personal details. Confirm your factual notes with the interviewee, distinguishing explanations from verified observations. If a specialist is needed to interpret cloud events, retain auditor responsibility for the conclusion and keep the specialist independent of the work tested.

Sample, test and evaluate exceptions

Checking selected apples means recording both the good ones and the bruised ones. The total checked gives the failures meaning. The selected access sample is 16 of 40 departures. Six of eight privileged accounts were disabled within the 24-hour deadline. P-03 took 72 hours and P-07 took 96 hours. Immutable evidence (EV) logs EV-17 and EV-18 confirm both delays against personnel records. All eight sampled nonprivileged accounts met the deadline. Record the full sample, including successful tests, so the exception count has a denominator.

The two privileged exceptions trigger expansion to all 12 privileged departures in the preceding quarter and an investigation of queue coverage. Document this as additional work with its own population and results, not as evidence that all original 40 were tested. Neither two of eight nor two of sixteen supports a statistical company-wide failure rate because selection deliberately favored high-risk users.

Four recovery exercises were due and four signed reports exist. One disaster recovery (DR) exercise, DR-04, completed recovery in six hours according to EV-24. The other three met four hours. A report labelled successful does not override measured elapsed time. Separate the conclusion about meeting the recovery target from whether the exercise was performed. Preserve test procedures, expected results, observed results and reviewer sign-off so another auditor can reproduce the conclusion.

Write findings that survive challenge

If a parcel arrives late, compare its arrival with the promised deadline. Do not guess why it was late or claim harm you have not seen. A finding connects the criterion, observed condition and traceable evidence, then explains the risk without claiming an unobserved breach. F-01 cites IAM-04 version 3 and the 24-hour requirement. It records eight privileged accounts tested and two late removals at 72 and 96 hours, supported by EV-17 and EV-18. The exposure is continued privileged access after departure, not proof of data theft. F-02 cites REC-02 version 2, the four-hour target and DR-04 taking six hours, with EV-24.

Cedar uses major for an absent or systemically ineffective process, minor for a bounded lapse in an otherwise operating process. Also, Observation only when no unmet requirement has been established. These are the agreed internal grading rules, not an automatic certification-body verdict. With the evidence currently available both findings are minor. Revise classification if expanded testing establishes systemic failure. Two exceptions alone do not prove a systemic collapse.

Agree factual accuracy with owners, but do not negotiate an evidenced nonconformity, a failure to meet a requirement, into an observation to improve a dashboard. Do not invent root cause: a missed queue route is an investigation hypothesis until management confirms it. The auditor states the gap and required outcome. Management chooses corrective action. In the findings lab, write structured criterion, condition, evidence, risk and classification fields using the supplied result set.

Close the meeting without closing the findings

Agreeing that a tap leaks does not mean the tap is fixed. A closing meeting confirms findings, not completed repairs. Before the closing meeting, review evidence sufficiency with the audit team and separate confirmed findings, unresolved facts and scope limitations. Present the objective and work performed, sampling boundaries, positive observations and each nonconformity, a failure to meet a requirement, with its evidence. Invite factual corrections and record disagreements and their disposition. Refusing to agree does not erase valid evidence.

For F-01, the identity lead owns immediate removal of remaining stale access and a corrective-action proposal by 20 April. For F-02, the operations lead owns a recovery bottleneck investigation and a proposal by 22 April. The target implementation date for both is 15 May, with an independent effectiveness check in June. Confirm these dates, owners and the escalation route in the minutes.

An urgent active privileged account is notified immediately through the agreed security route, not held for the closing meeting. Correction contains the specific lapse. Corrective action addresses its cause and recurrence. Auditor verification remains separate from management implementation. The closing meeting completes fieldwork communication, not corrective-action closure.

Issue a decision-ready audit report

A clear repair report helps a homeowner decide what to fund next. An audit report should also support decisions. The signed report records sponsor and audit team, objectives, scope, criteria and versions, dates, methods, populations and sample selections, limitations, findings, conclusion and action owners. Link evidence references in the restricted repository rather than distributing raw personal records. The audit lead approves release to the sponsor, process owners and audit committee according to the agreed distribution list.

The conclusion says the sampled processes showed bounded access-removal and recovery-target failures and that corrective action is required. It does not say Cedar is certified or fully compliant with every requirement. Report the extended-test status explicitly. If further work is incomplete, describe the limitation and any provisional aspects of the conclusion. A management response is included with attribution and does not rewrite the auditor evidence.

Track each finding in a register with its criterion, risk, owner, due date, status and evidence links. Distinguish report issue date from action due date and follow-up date. A useful report enables a decision about exposure and resources, while a collection of screenshots without conclusions forces leaders to guess. The review lab challenges draft wording before this report is released.

Follow up, verify effectiveness and close

A repair ticket marked done does not prove the leak has stopped. Check the repair in use before closing the problem. Management disables stale accounts as correction. It confirms that a personnel-feed mapping omitted privileged contractors as root cause. It repairs the mapping and adds monitored exception routing as corrective action. For recovery it removes a restore serialization bottleneck and tests the revised runbook. These explanations require supporting investigation and implementation evidence, not merely a statement that staff were reminded.

In June, Mira independently reconciles all 10 new departures to identity records, including three privileged contractors, and verifies that every removal met 24 hours. She tests alert routing for an intentionally delayed synthetic request under approved safe conditions. She witnesses a fresh restore completing within four hours. Link this follow-up evidence to F-01 and F-02 and assess whether the causes were addressed, not just whether a ticket was marked done.

Close each finding only after authorized independent review accepts implementation and effectiveness evidence. If testing fails, keep or reopen the finding, set a revised action and escalate overdue exposure under the programme rules. Retain the report, evidence and closure decision according to the audit retention schedule. Feed recurring problems and lessons into the next programme review and management review, completing the assurance cycle.