5.5 Audits & assessments
📘CompTIA Security+ (SY0-701)
1. Overview
Audits and assessments are essential parts of an organization’s security and compliance program. They help verify that security controls, policies, and procedures are effective and meet legal, regulatory, and organizational requirements.
This section focuses on attestation and two main types of audits:
- Internal audits (performed within the organization)
- External audits (performed by outside parties)
2. Attestation
Definition
Attestation means providing formal confirmation or verification that certain security controls, policies, or processes are in place and working correctly.
It is often a written statement or signed declaration that confirms compliance or accuracy.
In simple terms, attestation says:
“We confirm that this system or process meets the required standards and has been tested or reviewed.”
Purpose of Attestation
- To show trust and transparency in security and compliance practices.
- To provide evidence to regulators, customers, or partners that the organization meets standards (like ISO 27001, SOC 2, or PCI DSS).
- To document accountability — the organization or individual officially takes responsibility for the accuracy of the information provided.
Examples in IT Environments
- A cloud service provider attests that they have implemented required encryption controls and access management policies.
- A company’s IT manager attests that regular vulnerability scans and patch management activities are being performed.
- An organization provides an attestation report to customers confirming compliance with data protection requirements (e.g., SOC 2 Type II report).
3. Internal Audits
Definition
An internal audit is an independent review performed by employees within the organization to check if internal processes, policies, and controls are effective and compliant.
These audits are not performed by regulators or outsiders — they are self-checks done before any external party reviews the organization.
Purpose
- To evaluate internal security controls.
- To identify gaps or weaknesses before regulators or clients do.
- To ensure compliance with internal policies and standards.
- To prepare for external audits.
Types of Internal Audits
- Self-Assessment:
- Conducted by departments or individuals to check their own compliance.
- For example, an IT team reviews whether their patch management policy is being followed.
- Audit Committee:
- A formal group (often part of corporate governance) that oversees the internal audit process.
- The committee ensures that audits are objective, findings are reviewed, and corrective actions are taken.
Key Activities in Internal Audits
- Reviewing security policies and procedures.
- Checking access control lists, log management, and incident response records.
- Verifying configuration management and change control processes.
- Ensuring compliance with industry standards or company policies.
Outcome of Internal Audits
- A report showing areas of compliance and non-compliance.
- Recommendations for corrective actions.
- A follow-up plan to address weaknesses.
4. External Audits
Definition
An external audit is conducted by an independent third party or regulatory authority to evaluate whether the organization complies with specific laws, regulations, or standards.
These are formal audits that often result in official reports used by clients, regulators, or the public.
Purpose
- To validate internal controls from an independent perspective.
- To prove compliance with external regulations (e.g., GDPR, HIPAA, SOX).
- To build trust with customers and partners.
- To demonstrate accountability to stakeholders.
Types of External Audits
1. Regulatory Audits
- Performed by government or regulatory agencies.
- Aim to ensure that the organization follows laws and regulations.
- Examples in IT:
- A financial institution being audited for compliance with data protection laws.
- A healthcare company being reviewed for compliance with HIPAA.
2. Independent Audits
- Conducted by external independent auditors or firms, not by government agencies.
- Provide objective verification of compliance or control effectiveness.
- Examples in IT:
- A company hiring an independent security firm to conduct a SOC 2 or ISO 27001 audit.
- An external cybersecurity assessor reviewing network security configurations and incident response procedures.
Key Activities in External Audits
- Reviewing security documentation (policies, procedures, logs).
- Testing technical controls (e.g., encryption, firewall, access control).
- Interviewing key staff about compliance processes.
- Producing an audit report or attestation report summarizing findings and compliance status.
5. Differences Between Internal and External Audits
| Aspect | Internal Audit | External Audit |
|---|---|---|
| Performed By | Internal employees or internal audit team | Independent or regulatory auditors |
| Objective | Improve internal processes and prepare for compliance | Verify compliance for regulators or customers |
| Frequency | Regularly scheduled (monthly, quarterly, annually) | Usually once per year or as required |
| Scope | Internal controls, policies, and efficiency | Compliance with external standards or laws |
| Reporting To | Management and audit committee | Regulatory body, clients, or public report |
| Focus | Improvement and prevention | Verification and validation |
6. Relationship Between Attestation and Audits
- Audits (internal or external) gather evidence.
- Attestation is the formal declaration that the audit results are accurate and compliant.
- In many cases, external auditors issue attestation reports to certify compliance (e.g., SOC 2 Type II attestation).
7. Importance in the Security+ Exam
For the CompTIA Security+ SY0-701 exam, remember these key points:
- Attestation = Formal confirmation or proof that security controls are effective.
- Internal Audit = Conducted inside the organization to find and fix issues.
- Audit Committee = Oversees internal audits to ensure independence and accountability.
- Self-Assessment = Departments check their own compliance status.
- External Audit = Done by an outside or regulatory entity to verify compliance.
- Regulatory Audit = Conducted by a government or authority for compliance.
- Independent Audit = Conducted by third-party auditors to confirm security posture.
8. Summary
- Internal audits help organizations self-check and improve before facing external scrutiny.
- External audits confirm compliance and build trust with outsiders.
- Attestation is the official statement that controls are effective and compliance has been verified.
- Together, they form a continuous compliance cycle — assess, verify, improve, and prove compliance.
