Roadmaps Security roadmaps Governance, risk, compliance and audit
Test whether controls really work: plan and run IT and security audits, gather evidence, report findings fairly, and support certification and attestation.
Estimated time: 15–27 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Audit gives independent assurance that controls exist and operate. Learn the difference between audit, assessment, review and testing, and who relies on each.
Internal, external, certification, attestation and regulatory audits differ in purpose, independence and output. Know which you are doing.
Each control has an objective and a way to test it: inspection, observation, inquiry, re-performance. Design tests that would actually catch failure.
Evidence must be sufficient, reliable and relevant. Learn sampling, what makes a screenshot acceptable, and how to document a test so it can be reviewed.
COBIT, ISO 19011, the IIA standards and the AICPA attestation standards shape how audits are done. Learn the ones used in your context.
An audit is only worth what its independence protects. Learn conflicts of interest, confidentiality and how to hold the line politely.
Risk-based planning decides what to audit and how deep. Define scope, criteria, resources and schedule, and agree them with the auditee.
Interview control owners, inspect systems, re-perform processes. Ask open questions, verify what you are told, and keep clear working papers.
Pull configuration, logs and access data yourself where you can. Auditors who can read a config find things interviews never reveal.
A finding states condition, criteria, cause, effect and recommendation. Rate it fairly and aim at the root cause, not the symptom.
Write reports that executives can act on and that stand up to challenge. Lead with what matters, be precise, and avoid both drama and softening.
Certification and attestation audits follow set stages and rules. Learn them from both sides: as an auditor and as the person being audited.
Map everything that could be audited, rate it by risk, and build a multi-year plan. Cover the high risks often and the rest in rotation.
Automated tests of controls across whole populations replace yearly samples. Build the data feeds and the analytics.
Query logs, access lists and transactions directly to find anomalies and test full populations. SQL and a little Python go a long way.
Regulators audit too, with their own rules and consequences. Learn how examinations run and how to prepare the organisation.
Rely on others' audit reports, such as a vendor's SOC 2, correctly: read the scope, exceptions and complementary controls, not just the opinion.
Findings only matter if they are fixed. Track actions, verify closure with evidence, and escalate what is overdue.
Audit committees want the significant findings, the trend, management's response and your independent view. Learn to brief them well.
Set the methodology, working paper standards, review process and training that make every audit reliable.
Combine internal audit, external audits, certifications and continuous monitoring into one assurance map so nothing is covered twice or not at all.
Auditing checks that what an organisation says about its security is true. An auditor plans the scope, tests controls against a standard, gathers evidence, and reports findings with enough rigour that others can rely on them.
The field spans internal audit, external certification and attestation audits such as ISO 27001 and SOC 2, regulatory examinations and technical assurance reviews. It needs independence, method and a good nose for the gap between the policy and the practice.
Customers, regulators and boards rely on audits to trust an organisation's security. Good auditors find the real gaps before attackers or regulators do, and bad audits give false comfort. The skills are in demand on both the auditing and the audited side.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact