Internal audit practice¶
The third line, in practice¶
Lesson 2.2.B placed internal audit in the third line: independent assurance that the first line (the owners who run controls) and the second line (the cyber-GRC function that sets and monitors them) are actually working. Testing controls yourself (Lesson 3.6.A) is second-line work. Internal audit is the independent check on top, and it is how the board gets assurance it can trust, because it does not come from the people who built or run the controls. This Lesson is how that audit is actually done.
The audit cycle¶
A competent internal audit follows a repeating cycle, and its discipline is what separates assurance from a friendly chat:
- Plan, risk-based. You cannot audit everything, so you audit where the risk is. Scaldimet's first internal audit should go straight to the highest-risk area: Beta's OT and the contractor access, not the tidy Alpha office.
- Scope and prepare. Define exactly what is being audited and against what criteria (the relevant CyFun and ISO controls), and notify those involved.
- Fieldwork. Gather evidence and test both design and operating effectiveness using the methods from the last Lesson, favouring inspection and re-performance over inquiry, across a period and a sample.
- Findings. Record what was found, rated by severity (a systematic failure of a control is a major finding; an isolated lapse is minor), each backed by the evidence, not by opinion.
- Report. A clear report to the audited owners and, in summary, to the security committee and board: what was tested, what was found, and what it means for risk.
- Corrective action and follow-up. Findings are assigned owners and dates, and the auditor follows up to confirm they were actually fixed. An audit whose findings are not followed up does not provide effective assurance.
Independence is the whole point¶
Audit's value comes entirely from its independence. An auditor must not assess their own work, because no one reliably finds fault in what they built. This creates a genuine tension at a company Scaldimet's size: the CISO sets and monitors the controls (second line), so the CISO cannot also be the independent auditor of them (third line). The options are to use a different internal function, the internal-audit capability of the parent if there is one, or an external auditor for the assurance role. What you must not do is let the second line mark its own homework and call it assurance. Naming this tension, and resolving it deliberately, is itself part of good governance (Lesson 2.2.B).
Three kinds of audit, not one¶
It helps to keep three distinct things apart, because they are often muddled:
- Internal audit: your own (or your parent's, or a hired) independent check, for management's and the board's assurance. You control its scope and timing.
- Certification audit: the accredited certification body's Stage 1 and Stage 2 audits for ISO 27001 (Lesson 3.3.B). External, to a fixed standard, resulting in a certificate.
- Regulator inspection: the authority's own supervision (in Belgium the CCB can inspect, including proactively for higher-tier entities). Not optional, and backed by enforcement.
A strong internal audit is how you prepare for the other two: it finds the problems before the certification body or the regulator does, when fixing them is cheaper and entirely in your hands.
Application: plan a first internal audit¶
On paper, plan Scaldimet's first internal audit. Decide: the scope (the highest-risk area, almost certainly Beta's OT access), the criteria (the relevant CyFun and ISO controls), what you would test and how (inspect the access-review records and the segmentation configuration over six months), who can perform it independently (not the CISO who set the controls), and how findings would be reported and followed up. The plan should make clear how independence is preserved, because without it the exercise is not an audit.
Key takeaway
Internal audit is third-line independent assurance that the controls actually hold, and it is how the board gets trustworthy comfort, because it does not come from those who built or run the controls. It follows a risk-based cycle: plan where the risk is, scope, do evidence-driven fieldwork, rate findings, report, and follow up to closure. Its value depends entirely on independence, which at a small company means the CISO cannot audit their own controls and must arrange a genuinely separate auditor. Internal audit differs from the ISO certification audit and from regulator inspection, and a strong internal audit helps you prepare for both, by finding weaknesses before the certification body or regulator does.