How it unfolds
Five phases, nine weeks
The schedule below is indicative: it assumes documents arrive within ten days and that interviewees are available.
Preparation and scoping9 days · weeks 1 and 2
Kick-off meeting with the Internal Audit Department and the CISO. The scope, applicable frameworks and risk level of each domain are agreed. Four domains are rated high risk: access, continuity, incidents and suppliers.
Output: the audit plan and the document request list, sent the same day.
Document review9 days · weeks 2 and 3
Documents received are ticked off the list. Reminders go out on D+10. Reading the policies already makes it possible to set aside a few irrelevant questions and to focus the testing.
Output: the document tracking list and the adjusted work programme.
Testing and interviews27 days · weeks 4 to 7
Each sheet is performed: test steps, sample, evidence. Each question receives a score from 1 to 4 against its own criteria, and every score of 3 or 4 is documented with an observation.
Output: the scored questionnaires and the evidence files.
Summary and debrief9 days · week 8
Scores are consolidated by domain. Findings are validated with the auditees, then presented to management.
Output: the summary of scores and the debrief presentation.
Final report6 days · week 9
Report, prioritised action plan and mapping table: for each requirement of the selected frameworks, the test that covers it and its result.
Output: the report and the action plan.
The audit plan
The days follow the risk
The generator allocates the 27 testing days in proportion to the risk assigned: three days for a high-risk domain, two for medium risk, one for low risk.
Fictitious engagement: assessment of an insurer, 60 person-days, standard depth. The figures below are calculated using the generator's rule.
Phases and effort
| Phase | Days |
|---|---|
| Preparation and scoping | 9 |
| Document review | 9 |
| Testing and interviews | 27 |
| Summary and debrief | 9 |
| Final report | 6 |
| Total | 60 |
Allocation of testing by domain
| Domain | Risk | Testing days | Questions available |
|---|---|---|---|
| Governance and policies | Medium | 2 | 21 |
| IT risk management | Medium | 2 | 20 |
| Human resources and personnel | Low | 1 | 20 |
| Identity and access management | High | 3 | 20 |
| Physical security and equipment | Low | 1 | 20 |
| Network security and monitoring | Medium | 2 | 20 |
| Vulnerabilities and patching | Medium | 2 | 20 |
| Change management and development | Medium | 2 | 21 |
| Backup and continuity | High | 3 | 20 |
| Incident management | High | 3 | 20 |
| Suppliers and cloud | High | 3 | 22 |
| Personal data protection | Medium | 2 | 6 |
| Artificial intelligence | Low | 1 | 6 |
The documents requested
The list goes out on kick-off day
It is sent with a return date of ten working days, then serves as a tracking table. Extract, with the fictitious status of documents received at D+10:
| Domain | Document requested | For question | At D+10 (fictitious) |
|---|---|---|---|
| ACCE | Current access and authorisation management policy | ACCE-14 | Received |
| ACCE | Reports of the last two access reviews, with owners' approvals | ACCE-14 | Received |
| ACCE | Removal tickets and access listings before and after the latest review | ACCE-14 | Pending |
| ACCE | List of privileged accounts and multi-factor authentication settings | ACCE-11 | Received |
| CONT | Backup policy and minutes of the latest restore tests | CONT-04 | Received |
| INCI | Incident classification procedure and incident register for the last twelve months | INCI-15 | Received |
| INCI | Major incident notifications sent to the authority, with their dates | INCI-15 | Pending |
| TIER | Register of ICT third-party providers and contracts for critical services | TIER-14 | Received |
| TIER | Exit strategies and reports of reversibility tests | TIER-14 | Pending |
One test, step by step
The access rights review (ACCE-14)
Sheet ACCE-14, shown in full on the page The Method, asks whether access rights are periodically recertified by application or data owners. Here is what the auditor found, step by step.
| No. | Test step (sheet) | Finding (fictitious) |
|---|---|---|
| 1 | Obtain the frequency set by the policy and the last 2 reviews | Policy: half-yearly review. January and July reviews obtained. |
| 2 | For the latest review, check the scope, the approvers and the return date | 5 critical applications in scope, 5 reviews carried out. Responses received within three weeks. |
| 3 | Check that rights to be removed were actually removed (compare before and after) | 48 rights to be removed; 9 still active one month after the review, i.e. 19%. |
| 4 | Reconcile approvers with the designated owners | Compliant for 4 applications out of 5; one review approved by a delegate who had not been designated. |
Unsatisfactory. Criterion 3 of the sheet: removals not carried out for 10 to 25% of rights.
Observation: the review is performed, but it is not fully effective, since 9 rights out of 48 remain active. Recommendation: link each removal to a ticket and check that it is closed before closing the review.
Test once, cover everything. This single test addresses ISO/IEC 27001:2022 Annex A.5.18, NIS2 Art. 21(2)(i) and NIST CSF 2.0 PR.AA-05 at the same time. The finding is written once and carried over into the mapping table for each of these texts.
The summary of scores
What management reads first
Average score by domain (1 = satisfactory, 4 = critically unsatisfactory), number of findings scored 3 or 4, and main finding. All values are fictitious.
| Domain | Assigned risk | Average | Scores of 3 or 4 | Main finding |
|---|---|---|---|---|
| Governance and policies | Medium | 1,9 | 1 | — |
| IT risk management | Medium | 2,0 | 2 | — |
| Human resources and personnel | Low | 1,4 | 0 | — |
| Identity and access management | High | 2,6 | 4 | Incomplete removal of rights after review (ACCE-14) |
| Physical security and equipment | Low | 1,3 | 0 | — |
| Network security and monitoring | Medium | 2,1 | 2 | — |
| Vulnerabilities and patching | Medium | 2,5 | 3 | Critical patches applied late on part of the servers |
| Change management and development | Medium | 2,0 | 1 | — |
| Backup and continuity | High | 2,2 | 2 | Restores tested on a partial scope (CONT-04) |
| Incident management | High | 1,9 | 1 | — |
| Suppliers and cloud | High | 2,7 | 4 | Exit strategies not tested for two critical services (TIER-14) |
| Personal data protection | Medium | 1,8 | 0 | — |
| Artificial intelligence | Low | 2,8 | 2 | Ungoverned use of generative AI tools (IA-05) |
Reading: suppliers and access account for most of the gaps, as the plan's weighting had anticipated. Artificial intelligence, rated low risk at scoping, comes out with a high average: a point to raise when scoping the next engagement.
The deliverables
What the entity receives
At the end of the engagement, every deliverable flows from the same scoping and the same sheets: nothing is re-keyed from one document to the next.
- The audit plan and the work programme
- The document request list, then its tracking
- The scored questionnaires, with observations and evidence
- The summary of scores and the debrief presentation
- The report, the prioritised action plan and the mapping table
Is your context different? I build the plan with you, based on your obligations and your risks, and send you a tailored proposal.
Contact me →