- Welcome to lesson 27,
explain types of audits and assessments.
In 27.1 we're gonna focus in on audits,
but we're gonna start
with a general discussion about security assessments.
An information security assessment is a process
of determining how effectively the entity being evaluated
meets specific criteria.
Now, there are two approaches, examination and testing.
Examination is the process
of interviewing, reviewing, inspecting, studying
and observing to facilitate understanding or comparing
to standards or baselines or to obtain evidence.
It's often referred to as a passive approach
because we're not interacting necessarily with systems.
Now, audit is an examination
so we'll be talking about audit shortly
and that's gonna be a good example of doing an examination.
Testing is the process of exercising objects
under specified conditions to compare actual
and expected behavior.
A good example of testing would be penetration.
Testing is generally considered intrusive, right?
Because we're interacting with the system.
And after we do our lesson about audit
we actually have two lessons about penetration testing.
Now, assurance is the measure
of confidence that intended controls,
plans and processes are effective in their application.
The objective of an audit
is to provide independent assurance
based on evidence,
and there are some really key words there.
Independent and evidence.
Auditors are bound
by auditing standards that require their independence
and all of their conclusions are based upon evidence.
The audit evidence is all of the information
whether obtained from the audit procedures
or other sources that's used by the auditor
in arriving at the conclusion
on which the auditor's opinion is based.
Before an audit commences, there will be an audit plan.
The audit plan is a high level description
of the audit work to be performed in a specific timeframe.
Now, the plan may include objectives, scope,
resource requirements,
intended evidence collection techniques, target audience
and reporting expectations.
Now, the audit plan will be documented
in what is called an engagement letter.
Now, the final audience for audit results
will either be executive or maybe a board audit committee.
So let's talk about audit focus.
An audit might focus on compliance,
meaning are we meeting applicable laws, regulations,
contracts and or industry standards and guidelines?
An audit focus might be security and privacy
which is about achieving appropriate levels
of confidentiality, integrity, availability, and privacy.
An audit could be on internal controls
and that's the evaluation of the design
of controls and assessment of the operational effectiveness
and efficiency of those controls.
Or the audit focus could be alignment to assure alignment
with organizational and or control objectives.
Now, very often in an audit, sampling is used.
Sampling is used to infer characteristics
about the population
based on the characteristics of the sample.
Evidence sampling is applying a procedure
to less than 100% of the population.
Now, sampling rule of thumb
how many samples you take
is often based on professional judgment,
but there are some guidelines.
An audit of a low risk target
generally requires a small sample.
An audit of a high risk target
generally requires a large sample or even a complete check.
Now, in scenarios where there are really strong controls
that might require just a small sample.
And in scenarios where there is weak controls
those will generally require a large sample.
But again, this will be at the discretion of the auditor.
Now, at the conclusion of an audit,
after the audit work has all been done and analyzed,
the auditor will issue an opinion.
Now, there are four audit opinions.
Unqualified, qualified, adverse, and disclaimer.
And no, unqualified doesn't mean
that the auditor was unqualified.
So what does it mean?
An unqualified opinion is rendered
when the auditor doesn't have any significant reservations.
That would be an unqualified opinion.
A qualified opinion is rendered
when there are some minor deviations or scope limitations.
An adverse opinion is rendered when the target
is not in conformance with the control objectives
or when the evidence is misleading or misstated.
And an audit examination report can also have a disclaimer
that the auditor was not able to render an opinion
due to whatever the named circumstances are.
An audit framework is a structured
and systematic approach that are used
by auditors to plan, execute
and report on an audit engagement.
Now, audit frameworks are typically developed
by auditing standard setting bodies.
Now, there are two very common types
of audits you wanna be familiar with.
First is the ISACA COBIT 5 audit framework.
Second is the AICPA.
That stands for the American Institute
of Certified Public Accountants.
Now, they have a framework known as the statement
on standards for attestation engagements number 18.
That's a mouthful.
What we really call it all the time is an SSAE18 report.
Now, why do you need to know about SSAE18 report?
Well, besides for your examination, it's probably the type
of audit report that you will most interact with.
It's a type of report that is generally issued
by a technology company to prove the type
of controls it has in place
and it's the one that we'll use in our due diligence.
So let's take a look at an SSAE18 report.
Well, there are actually three versions
of an SSAE18, a SOC1, a SOC2, and a SOC3.
A SOC1 is a report on controls relevant
to a user entity's financial statements
and there's an agreed upon scope
between the audit firm and the organization being audited.
It's not really relevant to us unless perhaps
you have some financial compliance requirements
like Sarbanes Oxley.
It's also what we used to call a SAS 70 report.
A SOC2 is the one that we really wanna be working with.
A SOC2 is based upon what's known
as a TSP, the trust services principles
and that reports on controls intended
to mitigate risk related to security,
availability, processing integrity,
confidentiality, or privacy.
Now, what's really interesting about the SOC2 report though
is it doesn't necessarily cover all five
of those categories.
The organization that's being audited gets to say
these are the categories I wanna be audited on,
maybe security and availability.
But perhaps what you really care about is privacy.
Well, if the report didn't cover that category
it's not gonna be useful to you.
The organization chooses a category
and you always wanna be cognizant
of those categories when you're reading the report
but they don't get to choose
what controls are going to be looked at.
The controls that are gonna be looked at
are determined by the auditor.
So they can choose the category
but they can't control the the scope
of what is going to be examined.
Now, a SOC2 report, generally you'll have to sign an NDA
before it'll be issued to you because there's a lot
of proprietary information about the organization
and about whatever the service or the application is
That is the target of the audit
as well as all of the testing will be detailed
and the results will be detailed.
So you get a lot of information.
It's really comprehensive.
It's incredibly useful
as long as it covers the categories that you care about.
Now, a SOC3 is very similar to a SOC2.
It's based on the TSP, the trust services principle
but it doesn't have any proprietary information.
So no NDA required
but it also doesn't detail any of the testing performed.
It's really a marketing piece designed
for public distribution.
So a SOC2 is the one that we really wanna be using.
And then there are two types.
There's a type one and a type two.
A type one reports on controls placed in operation
as of a point in time.
So it's an evaluation of design and implementation
but not operating effectiveness.
It's not how well it works,
it's just that on this date, the control was there.
Now we'll know it is a type one
because the cover of a report will show an as of date.
So maybe it says as of July one
as of January one, but they, as of date,
we'll say on that date, those controls were there.
We don't know how well they worked
but we know they were there on that date.
A type two reports on design, implementation
and operating effectiveness over a period of time.
Now, generally 6 months or 12 months
and that includes tests of operating effectiveness
and results over a period of time
with a very strong emphasis on evidential matter.
Now, how will you know you're getting a type two?
Because the cover of the report will show a time period
of generally 6 or 12 months.
So it might say January one through December 31st
or it might say July one through December 31st.
But it will have that period of time right on the cover.
So best of all worlds, what do we get?
A SOC2, type two.
And that, my friends, brings us to a three second challenge.
Are you ready?
Five questions, three seconds each.
Let's do it.
This process results
in independent evidence-based assurance.
1, 2, 3.
That's gonna be audit.
Number two, this type
of audit compares the control environment
to establish policies, standards, or rules.
1, 2, 3.
This is gonna be a compliance audit.
Are we in compliance with those policies of standards,
those rules or those regulations?
Number three,
techniques used to infer characteristics of a population.
1, 2, 3.
And that's gonna be sampling.
Number four,
an audit opinion rendered when the auditor
does not have any significant reservations.
1, 2, 3.
And that's gonna be an unqualified opinion
which always sounds weird, but that's what it is.
And number five, audit assessment standard
most commonly used
by technology oriented service organizations.
You know this.
1, 2, 3.
This is an SSAE18 SOC2.
Alright, let's take a look at our security-in-action.
This one's about an audit dispute.
You brought in an outside audit firm
to conduct an information security internal controls audit
for a recently acquired division.
Throughout the audit, the target division manager
has been really difficult to work with.
And during the exit interview of the audit,
he questioned the auditor's competency.
And at the management meeting
he hotly disputed the audit findings.
How are we gonna handle this situation?
So a quick recap.
We've brought in this outside audit firm.
They're gonna conduct an information security
internal controls audit
for a division that we recently acquired
and the target division manager
really, really difficult to work with.
And then the exit interview
that was when our auditors were leaving, you know,
he questioned the auditor's competency.
It's like, you don't know what you're doing, kind of thing.
And at the follow-up management meeting
he hotly disputed the audit findings.
So how are we gonna handle this situation?
What do you think?
Go ahead and put me on pause and think about your response.
Well, you may wanna start with ask the manager
to explain the dispute and the competency concerns.
Give them some agency.
Let them, you know,
explain why they're so concerned about this,
or why they disagree so vehemently
that if there is sufficient cause
we should revalidate the audit testing
and the sampling techniques as well as the evidence
to ensure that it does support the audit findings.
Now, if after reevaluating and maybe retesting
or choosing not to, depending on what you do,
there are still unsettled disagreements.
The issue should be included
in the final report that will go to an audit committee
and having to deal with these difficult situations
but finding our way through security-in-action.
Alright, there's your word cloud.
Make sure you know it all
before you move on to our next two lessons
where we're gonna be talking about penetration testing.
I'll see you there.