Step 1: The Finding
In short
Everyone is talking about the same thing, nobody uses the same words: why IT audits repeat themselves from one framework to the next.
Finding no. 1:
Guy Mrejen
When I test a control, an access rights review for example, I want to know which requirements I am covering, in which texts, under which articles, and which one is the strictest.
I asked auditors, CISOs, consultants and software vendors. Nobody knows every framework, and neither do I. Not for lack of skill, but because of the "standards jungle".
That is where I started: I took the problem the other way round. I started from the audit question, not from the standard.
Everyone is talking about the same thing, nobody uses the same words: why IT audits repeat themselves from one framework to the next.
Standards are complex; your audit should not be. One simple audit question, mapped to every framework, and a generator that turns it into the audit plan.
The Method applied to a fictitious engagement, step by step: the audit plan, the documents requested, one test performed and the summary of scores.
My background, my areas of expertise and the way I work.
Already know what you need? Contact me →