Findings that say whether anyone actually checked.

How it runs

Five stages: scope and criteria, a single batched evidence request, examination, interviews last, then reporting with owners and dates. Criteria are agreed before any evidence is seen, because criteria written afterwards can move to accommodate whatever turned up. The audit process covers each stage and its characteristic failure.

Scope is a written plan of questions rather than a list of systems — the write-up on audit plan covers the five components, including the two most plans omit: what is out of scope, and how the sample is chosen.

Everything is applied per system, which is why the first deliverable is usually an inventory. More on information systems covers why the existing list is nearly always wrong and how to build one that is not.

Depth, compliance, and who performs it

A shallow pass across the estate and a deep pass on one system answer different questions — system audits covers which to run and how to choose the subject. Where an external standard supplies the criteria instead of your own risks, IT compliance audit covers what that proves and what it does not, and more on compliance information covers the records those standards require you to hold.

On who does the work, the write-up on information technology auditor covers what independence requires and where it quietly breaks. If you are the one being reviewed, audit experience — the short version covers what to prepare and what not to bother with.

Related engagements: how fractional cto services works here for ongoing technical oversight, and what outsourced cto services covers where the whole function needs an owner.

What you can inspect

The egress policy agent demo takes a real capture of outbound network traffic and generates a least-privilege policy from it. On a two-minute capture it enforces 0 of 19 destinations and says so, because a process name is not a stable identity and two minutes is not a baseline.

That is the same standard applied to your systems: a finding that says what was checked, and an explicit account of what the evidence does not support.

What an audit cannot tell you

It cannot tell you that you have not been breached. It examines controls and evidence, not forensics, and a clean result is entirely consistent with a compromise nobody has detected. If that is your question, you need incident response.

It does not certify anything. Where a counterparty requires a specific standard, that needs a qualified assessor, and I am not one — I can establish the gap between where a system is and what a standard requires, which is a different job by design.

And it is not a penetration test. I do not offer assurance that a system resists a determined attacker, and anyone bundling the two is selling you one of them.