IT & Security Audit

Compliance preparation gets you ready to be assessed. Audit establishes whether the controls you believe are running actually are.

We test control design and operating effectiveness, gather the evidence, and report what holds and what does not. The work is done to audit standards by certified auditors — which matters when the report has to satisfy somebody other than you.

An engineer reviewing systems in a data centre
A control nobody has tested is an assumption
Who this is for

Four reasons organisations commission an audit

An external assessor is coming

You would rather find the gaps yourself, while there is still time to close them, than have someone else find them for you.

You have internal audit obligations

A committee or a board requires periodic assurance over IT controls, and the expertise to deliver it is not in house.

Nobody has verified the controls

They were implemented, documented and then left. Whether they still operate is genuinely unknown.

A customer wants evidence

A contract or questionnaire requires independent confirmation that specific controls are in place and working.

What we audit

Scope is set with you, from the areas that carry the risk

Access and identity controls

Provisioning, review, revocation and privileged access. The area that fails most often, because leavers are quieter than joiners.

Change management

Whether changes are authorised, tested and traceable — and whether the emergency route has quietly become the normal one.

Backup and recovery

Not whether backups run, but whether restoration has been proven and within what tolerance.

Monitoring and logging

Whether the events that matter are captured, retained for as long as required, and reviewed by someone.

Third-party and outsourced controls

What your providers are contractually obliged to do, and what evidence you hold that they do it.

Control framework alignment

Testing against the framework you are held to, whether that is ISO 27001, a regulatory expectation or a customer requirement.

How we work

Evidence, not assertion

01

Agree scope and criteria

Which controls, measured against which framework, and what constitutes passing. Settled in writing before fieldwork begins.

02

Test design

Whether the control, as designed, would actually achieve its objective. A well-run control aimed at the wrong thing still fails.

03

Test operation

Sampling actual activity over the period to establish whether the control ran consistently, not just on the day someone looked.

04

Report

Findings with evidence, rated by consequence, and written so that both the control owner and the audit committee can use the same document.

Deliverables

What you receive

  • An audit report covering control design and operating effectiveness, with findings supported by the evidence tested
  • A documented testing basis — what was sampled, over what period, and against what criteria
  • Management actions agreed with the control owners rather than issued at them
  • A remediation tracker you can carry into the next cycle and report against
  • A summary for the board or audit committee in language that does not require a technical reader
Scoping

Timing and cost

Cost depends on how many controls are in scope, how many systems and locations they span, and the state of your existing evidence. Where documentation is current and owners are identified, fieldwork moves quickly; where it is not, reconstructing it is the bulk of the work.

We do not publish packages or rates. Every engagement begins with a short call, followed by a written scope and a fixed price for that scope before any work starts.

What we need to scope it

Which framework you are held to, what triggered the requirement, whether an audit has been done before, and who owns the controls today.

FAQ

Common questions

Is this the same as your compliance service?
No, and the difference matters. Compliance work builds the programme and prepares you to be assessed. Audit independently tests whether controls operate as intended and produces evidence of that. Organisations often need both, and it is worth being clear which one you are buying.
Can you issue a SOC 2 or ISO certificate?
No. Certification must come from an accredited certification body, and any firm telling you otherwise is worth avoiding. What we do is test your controls to audit standards beforehand, so that the assessment that does certify you holds no surprises.
Can you audit us if you built the controls?
Not with any real independence, and we will say so rather than take the work. If we have designed or implemented a control, we can help you prepare for someone else to test it — but we should not be marking our own homework and calling it assurance.
How disruptive is fieldwork?
Most of it is evidence review and short interviews with control owners. The demand on your team is real but bounded, and we agree the schedule in advance so it does not arrive unannounced.
What if we fail?
Then you have found out privately, from someone whose job is to help you fix it, rather than publicly from an assessor or an incident. A finding is the point of the exercise, not a failure of it.

Tell us what has to be assured, and to whom

The audience for the report usually determines the shape of the engagement. Thirty minutes is enough to establish both.

Start with a scoping call