Internal audits in information security: from a requirement to added value 

An internal audit is in many cases an annual requirement. Organizations with, for example, an ISO 27001 certificate, are subject to the DORA, or government organizations that must comply with BIO2, are faced with this requirement. But what does such an audit involve? And how do you choose a party that can conduct a high-quality audit that also aligns with your organization’s needs? In this article, we describe how an internal audit works and explain what you can expect from Nestor Security. 

What is an Internal Audit? 

An internal information security audit is an independent assessment of how an organization has set up its security measures. It also looks at the implementation of these measures. An audit verifies whether your organization meets the standards and obligations that apply to your specific situation. An annual audit also helps organizations to improve information security where necessary.  

Marcel Dusink, auditor at Nestor Security explains, “The basic idea of an internal audit is that an independent party looks inside the organization. We do not have all the inside knowledge of the internal situation, but we do have the expertise. Precisely this combination ensures that risks and areas for improvement can be sharply identified. Strange eyes compel.” Internal audits are part of a broader system of quality assurance and supervision. They help organizations to remain demonstrably in control and to be prepared for external audits. 

During an audit, the auditor gathers evidence through interviews, documentation review and technical checks. “An important part is determining what interviews to conduct and what evidence is needed,” Marcel explains. “For example, when incident management is being examined, an auditor wants to see how incidents are recorded and handled. With backups, we want to be able to determine that they are actually working. The results are recorded in a report with findings and recommendations. An audit almost always yields areas for improvement. Some are mandatory to resolve, others are recommendations. Both help the organization become more mature in information security.” 

Working with standards frameworks 

Internal audits are conducted using standard frameworks, such as ISO 27001, BIO or DORA. These frameworks contain concrete management measures that help organizations structure their information security. “Such a standard framework can be seen as a checklist,” explains Marcel. “We systematically check whether the organization complies with the agreed-upon measures. ISO 27001 is the best-known of these, with a large number of management measures divided across different domains.” 

Dividing audits into manageable parts creates a manageable and effective audit process. “We deliberately choose to divide audits into smaller, operational parts,” says Marcel. “This allows us to take a more focused look, connect better with the organization and ultimately perform higher quality audits.” 

An internal audit always has three distinct roles: the client, the auditor and the auditee. 

• The principal is the organization that initiates the audit and is responsible for following up on the results. 

• The auditorCarries out the research and must operate independently in doing so. 

• The auditeeIs the person or department within the organization whose activities are being examined during the audit. 

“An audit only works if the roles are clear and the process is carefully followed. The auditor must be given sufficient time and authority, and the organization must be well informed about the process and results. Transparency and hearing both sides of the argument are essential in this regard. We always present findings to the organization. The goal is not to surprise, but to give an honest and complete picture.” 

Nestor Security's approach 

At Nestor Security, the audit is not only focused on control, but also on helping organizations move forward. Marcel explains, “We let our investigation fit the context of the organization. In this way we ensure that we do not apply an unnecessarily strict interpretation of a management measure, but that it fits the way an organization does its work. Our approach is down-to-earth and pragmatic. We think along about how security can really be improved. In addition, we always ensure that auditors are independent. If we have helped somewhere with implementation, we do not carry out the internal audit ourselves. That is essential for objectivity. The most important thing is that organizations feel helped and given concrete tools to further improve.” 

Wondering what an internal audit from Nestor Security can do for your organization? Please contact us.