Part 2 of this article appeared in the December 2017 issue of Compliance & Ethics Professional.

Mark Lanterman (mlanterman@compforensics.com) is Chief Technology Officer at Computer Forensic Services, Inc., in Minnetonka, MN.

In the last two articles of this series, I discussed the role of maturity assessment and security assessment as connected though distinct aspects of a strong security program. This article will delve into a third and comparatively more in-depth component. Security auditing builds upon the information collected as a result of the security assessment portion in order to come to conclusions about the efficiency of an organization’s internal controls.

A security audit focuses on the completeness, design, implementation, and efficacy of internal security controls. Although controls are identified during the security assessment to mitigate identified risks, a security assessment provides only a rudimentary evaluation of the control design. Perhaps more importantly, a security assessment is conducted under the assumption that the controls are effective in mitigating risks. Conversely, a security audit will delve much deeper into how a particular control is designed and how it is implemented over a period of review. Periods of review are decided by management based on the amount of assurance desired that a control is operating as expected. This period typically lasts 12 months but can ultimately be any length of time depending upon the needs of the organization.