Governance · 7 min read
Building a security audit programme that finds what matters
A good audit programme is a portfolio of assurance decisions. It gives leaders confidence about the risks that matter, while giving control owners useful feedback before a weakness becomes an incident.
Published Oct 10, 2026 · By InfoSec Consult
Plan around risk, not departments
Start with the organization's risk universe and map auditable entities to critical services, information assets, suppliers, and obligations. This prevents the common mistake of auditing the same mature process repeatedly while missing a new SaaS platform, acquisition, or operational dependency.
Programme design principles
- Build the programme from business objectives, risk appetite, regulatory commitments, prior findings, and material changes—not a generic annual checklist.
- Define each audit objective, criteria, scope, independence requirement, skills, estimated effort, and expected decision before scheduling it.
- Prioritise high-impact processes and recently changed services, while retaining enough rotation to detect control drift in quieter areas.
- Use a consistent finding taxonomy and severity model. Separate control failure, design gap, isolated exception, and improvement opportunity.
- Reserve capacity for follow-up audits, emerging risks, incidents, and management requests. A fully booked programme is not a resilient programme.
- Report themes and overdue actions to leadership. The programme should change behaviour, funding, and risk treatment—not only produce reports.
Make sampling explainable
Document why locations, systems, users, suppliers, periods, and transactions were selected. Risk-based sampling does not need to test everything, but it must be defensible. Increase coverage where there are privileged users, manual overrides, repeated findings, sensitive data, or recent change.
Measure usefulness
Track more than the number of audits completed. Useful measures include repeat findings, time to validate corrective action, coverage of top risks, overdue remediation, control failures found by incidents versus audits, and stakeholder confidence. Review the programme quarterly and adjust it when the risk picture changes.