InfoSec and Compliance – With 20 years of blogging experience, DISC InfoSec blog is dedicated to providing trusted insights and practical solutions for professionals and organizations navigating the evolving cybersecurity landscape. From cutting-edge threats to compliance strategies, this blog is your reliable resource for staying informed and secure. Dive into the content, connect with the community, and elevate your InfoSec expertise!
Evaluates internal controls, risk management, and compliance to improve efficiency.
Provides an independent opinion on financial statements and compliance with regulations.
Conducted By
Internal employees or outsourced auditors reporting to management or the board.
Independent third-party auditors hired by shareholders or regulators.
Focus
Operational effectiveness, risk management, and compliance.
Accuracy and fairness of financial statements.
Regulation
Not legally required but recommended for governance.
Mandatory for public companies and regulated entities.
Frequency
Ongoing, conducted throughout the year.
Typically conducted annually.
Reporting
Reports to management and the board (Audit Committee).
Reports to shareholders and regulatory authorities.
Independence
May lack full independence due to internal employment.
Fully independent from the organization.
Internal audits help improve internal processes, while external audits ensure compliance and financial integrity. First party audits, known as internal audits, consider the effectiveness and efficiency of the Management System, whereas external audits consider only the effectiveness of the Management System.
DISC LLC presents a phase approach to deliver ISO 27001 Internal Audit services to SaaS businesses.
The Engagement:
We understand that your core business is your SaaS application and you desire an audit. The audit is to be an independent assessment of the company’s ISMS, to measure the maturity of the program, to identify if the program is ready to pass the certification audit for ISO 27001:2013 certification, and provide strategic guidance for achieving the certification. Our focus will be your application which is hosted at AWS/Azure and you have xxx employees who create, maintain, and manage the application.
The audit will be conducted remotely and we will have a dedicated contact person assigned to our audit team to facilitate access to documentation, records, and select staff for interviews. We will complete your standard audit process documentation according to the ISO 27001 standard.
The Plan:
Below is our high-level audit plan for your ISO 27001internal audit. We propose a staged and flexible approach so we may progressively tune our audit process to deliver maximum business value to you.
Phase 1: This phase starts within a week one of signing of an engagement contract. First step is a kickoff meeting to discuss the overall audit engagement, to finalize the formal audit plan, and to establish access to documents to be reviewed. We will review the available documents based on the ISO27001 standard. At the end of this phase we will present our findings in a briefing session.
Phase2: Phase 2 kickoff will be based on the document review and coordinate scheduling interviews that focus on critical processes to establishing the degree that the various control procedures have been activated. This is a critical part of the audit process. We will measure the maturity of required controls that has been implemented and present the findings for review within another review session (schedule subject to availability for interviews).
Phase 3: Recommendations will be the focus of this phase. This will also start with a kickoff meeting to establish a coordinated plan for what measures are already planned and what new measures are required to actually pass (to-be state) the certification audit. This final step can save you a lot of effort as we can help you navigate to the end goal of passing the audit and also create the precise measures that have maximum business value. The closing meeting of this phase will present our collective recommendations.
All of the efforts outlined above are aligned to a compliant internal audit process with a few enhancements that are value-add. These audit records will likely be a primary target of the certification audit so they need to be well executed. Your controls also have to be tailored to your business. We can help get you certified but that doesn’t mean you are actually secure. We can help you do both. Missing the secure part would be devastating to you and to all of your customers. This is our value-add.
If you have a question about ISO 27001 internal audit:
