Audit – What do we relate it to at first!! Accounts aren’t it? That’s what we have been hearing all our lives…. Well…the term simply means a thorough check on transactions (In or out), and this helps us and the company to work safe and be respected. Like we need and understand the requirement for a financial audit, similarly we should realize the need and importance for Technology Audit. When it comes to computer security/ cyber security, the role of auditors today has never been more crucial. Auditors must confirm that all computers, systems and data are secure. Management must build internal controls, security, and integrity procedures into its automated systems, so that ‘RIGHT’ happens all the time by default.

Your security policies are your foundation. Without secure policies and standards, there’s no guideline to determine the level of risk. But unlike finance policies from government or mandates from RBI which happens once in a term (unless an emergency), technology changes much more rapidly than business or financial policies and must be reviewed more often. Software vulnerabilities are discovered daily. A yearly security assessment by an objective third party is necessary to ensure that security guidelines are followed.

Security audits may not a bull’s eye in the first shot. We need to be regular with it and keep checking. We don’t need to wait until a successful attack forces our company to hire an auditor, we need to be proactive to prevent it rather than curing it. Annual audits establish a security baseline against which you can measure progress and evaluate the auditor’s professional advice. An established security posture will also help measure the effectiveness of the audit team. Even if you use different auditors every year, the level of risk discovered should be consistent or even decline over time.

If we don’t have backup/ reference of internal and external security reviews to serve as a baseline, consider using two or more auditors working separately to confirm findings. It’s expensive, but not nearly as expensive as following bad advice.