Methodology — Security Audit

Guiding principles

• Risk-led, not checklist-led — every control traces back to a business risk.
• Evidence-first delivery — every workshop ends with an artefact in your repository.
• Local context — Arabic, English and Hindi delivery, local regulator relationships.
• Single source of truth — one risk register, one control set, many audits.

Phase 1. Scope

Agree baseline, systems, locations and stakeholders.

• Stakeholder interviews across business, IT, security, legal and audit
• Document and tooling review against the applicable control set
• Heatmap of current-state maturity by domain
• Prioritised remediation backlog with effort and owner estimates

Phase 2. Fieldwork

Interviews, evidence review, control testing.

• Defined entry and exit criteria captured in the engagement charter
• Weekly progress reporting against an agreed traffic-light scorecard
• Outputs reviewed by a Lead Auditor before sign-off
• Lessons captured to refine the next Audit & Assurance engagement

Phase 3. Report

Findings, ratings and remediation roadmap.

• Defined entry and exit criteria captured in the engagement charter
• Weekly progress reporting against an agreed traffic-light scorecard
• Outputs reviewed by a Lead Auditor before sign-off
• Lessons captured to refine the next Audit & Assurance engagement

Phase 4. Validate

Re-test of remediated controls on request.

• Internal audit dry-run with formal findings register
• Management review with executive sponsor
• External audit liaison and observation room support
• Findings closure plan with target dates and owners

Quality gates

Each phase ends with a formal gate review attended by the engagement partner, your sponsor and any second-line stakeholders. No phase closes until the gate criteria are documented and signed off.

• Gate 1 — scope, RACI and risk appetite formally agreed.
• Gate 2 — control design reviewed and approved by your security committee.
• Gate 3 — evidence pack independently sampled before audit submission.
• Gate 4 — post-audit lessons-learned and continuous improvement plan signed off.