My answer: the DIAG.IT Method. One simple audit question, mapped to every framework, and a generator that turns it into the audit plan.
Discover the Method →The Finding
Everyone is talking about the same thing. Nobody uses the same words.
An ordinary week for an IT auditor:
DORA
Monday · The regulator
"Prove to me that your digital resilience is under control: critical providers, testing, major incidents."
Behind it: the register of ICT third-party providers, resilience testing and major incident reporting.
And the auditor? Taking notes, in five languages.
To find my way, I sort these texts into three layers.
- The obligationDORA, NIS2, GDPR, French Order of 3 November 2014, AI Act
They provide : the expected outcome, the obligations, the deadlines and the penalties. What they almost always lack is a way to verify it. The GDPR requires "appropriate" security. It does not say how to prove it.
- The what to doISO 27001 and 27002, NIST, ITIL, ISO 22301, PCI DSS
They provide : how to achieve the expected outcome, control by control. What they lack is the force of law. And each one has its own vocabulary, numbering and scope.
- The why and who decidesCOSO, IIA Standards, ISO 31000
They provide : who is accountable, and how to make sure the system works. What they lack are concrete controls to test. Perfect for the audit committee; for testing a user permission, much less so.
- The missing link
The audit question that links all three: what to ask for, what to test, what evidence is enough.
The good news
These layers do not compete: they fit together.
The bad news
Nobody will make the connection for you.
So audits pile up, and the same teams answer the same questions three months apart, under three different numbering schemes.
Missing link
Mapping tables do exist. They say that two references correspond. They do not say what to ask for, what to test, or what evidence is enough. Every auditor redoes that work alone, engagement after engagement.
Example. Access rights review appears in six texts (ISO 27002, NIST 800-53, NIST CSF, PCI DSS, SOC 2, DORA technical standards): six numbering schemes, a single question. Are access rights reviewed, by whom, how often, and on what evidence?