Compliance & certification
CISA / IS Audit
Independent information systems audit performed to CISA/ISACA standards.
Certification & audits
In plain terms Audit
What this is
Independent information systems audit performed to CISA/ISACA standards.
Why it can hurt you
Boards and regulators need an independent IS audit opinion, not a self-assessment marked "all controls effective."
Certification & audits
Why it matters to you Audit
The problem
Boards and regulators need an independent IS audit opinion, not a self-assessment marked "all controls effective."
Board-level assurance
Independent opinion the audit committee can rely on.
Regulatory credibility
Third-party attestation carries weight a self-review can’t.
Certification & audits
How we do it Audit
Scope & control identification
IT general controls and application controls identified for the audit period.
Evidence-based testing
Controls tested for both design and operating effectiveness.
Independent reporting
Findings reported without influence from the audited team.
Certification & audits
What we typically find Audit
Ineffective change management
Production changes deployed without documented approval trail.
Weak access provisioning controls
User access granted without consistent approval or periodic review.
No surprises on audit day.
We check what the auditor will check, first — so the audit is a formality.
Certification & audits
What lands on your desk Audit
IS audit report
Formal opinion on control design and operating effectiveness.
Management letter
Findings and recommendations addressed directly to leadership.
Certification & audits
What you get out of it Audit
Board-level assurance
Independent opinion the audit committee can rely on.
Regulatory credibility
Third-party attestation carries weight a self-review can’t.
Certification & audits
Step by step Audit
1. Scope & control identification
IT general controls and application controls identified for the audit period.
2. Evidence-based testing
Controls tested for both design and operating effectiveness.
3. Independent reporting
Findings reported without influence from the audited team.
Find out what we would find.
A scoping call is thirty minutes, costs nothing, and ends with a fixed price and a date. If we are not the right people for the job, we will tell you that too.