Internal and External Audit

Audit is the independent assurance function through which the organisation obtains the objective evaluation of its risk management, control environment, and compliance posture that neither management nor the governance bodies responsible for overseeing those functions can provide about their own performance. The governance value of audit derives precisely from this independence: the assurance that an independent evaluator provides about the adequacy and effectiveness of the organisation’s controls carries a credibility that self-assessment cannot achieve, because the independence of the assessor from the processes and controls being assessed removes the familiarity bias, accountability conflict, and self-interest that make internal self-assessment a necessary but insufficient source of governance assurance.

The ISO must understand and actively engage with both the internal and external audit functions as governance partners whose work provides intelligence and assurance that the security programme requires and cannot generate independently. The ISO who experiences audit as an adversarial inspection to be managed defensively rather than as a governance intelligence source to be engaged with constructively will consistently find that audit findings surprise rather than confirm, that audit relationships are characterised by friction rather than collaboration, and that the assurance value of the audit function is not available to the security programme’s improvement activities because the defensive posture that the adversarial orientation creates prevents the genuine engagement that assurance partnership requires.

Internal Audit #

Internal audit provides the independent assurance that the organisation’s risk management processes, internal controls, and governance structures are functioning as designed and delivering the outcomes they are intended to produce. Its remit extends well beyond financial scrutiny to encompass the operational, compliance, and information security control domains that the ISO is responsible for governing, making it one of the most important sources of independent assurance about the security programme’s effectiveness available to the ISO and the board.