FREN
Diag. IT · IT audit, risk and compliancePrepared by: Guy Mrejen, CISA
Portrait of Guy Mrejen

Finding no. 1:

Guy Mrejen

For years, I kept asking the same question. Nobody could really answer it.

When I test a control, an access rights review for example, I want to know which requirements I am covering, in which texts, under which articles, and which one is the strictest.

I asked auditors, CISOs, consultants and software vendors. Nobody knows every framework, and neither do I. Not for lack of skill, but because of the "standards jungle".

That is where I started: I took the problem the other way round. I started from the audit question, not from the standard.

Unresolvedfor 25 years
25 yearsof IT audit in banking and insurance
13audit domains
236detailed, scored questions
14core frameworks
411traced references
Guy Mrejen, CISA, founder of Diag. ITNext page: the Finding →
The site in four steps

First the problem, then the answer. Then the proof, on an engagement.

Step 1: The Finding

In short

Everyone is talking about the same thing, nobody uses the same words: why IT audits repeat themselves from one framework to the next.

Read the Finding →

Step 2: The Method

In short

Standards are complex; your audit should not be. One simple audit question, mapped to every framework, and a generator that turns it into the audit plan.

Discover the Method →

Step 3: Case study

In short

The Method applied to a fictitious engagement, step by step: the audit plan, the documents requested, one test performed and the summary of scores.

Read the case study →

Already know what you need? Contact me →

Contact me

Leave your details and I will get back to you to discuss your needs.

Your details are used first and foremost to answer your request. Without your consent above, they are not reused afterwards. They are never shared with anyone. See the legal notice.