{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/audit","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/audit/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/audit/"},"term":{"en":"Audit","da":"Audit"},"aka":{"en":["compliance audit","security audit","internal audit"],"da":["revision","intern audit"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","summary":{"en":"An independent check of whether an organisation actually follows its own policies and the requirements it has signed up to.","da":"En uafhængig gennemgang af, om en organisation faktisk følger sine egne politikker og de krav, den har forpligtet sig til."},"body":{"formal":{"en":"A planned, documented and impartial examination that gathers evidence - samples, records, interviews - to judge whether practice matches set criteria such as policies, contracts, laws or a standard, and reports each deviation as a finding.","da":"En planlagt, dokumenteret og upartisk undersøgelse, der indsamler beviser - stikprøver, dokumenter, interview - for at vurdere, om praksis svarer til fastsatte kriterier som politikker, aftaler, love eller en standard, og som rapporterer hver afvigelse som et fund."},"plain":{"en":"Like the regular car inspection - the owner may say the brakes are fine, but the inspector puts the car on the test bench and checks for real.","da":"Som når bilen skal til syn - ejeren kan godt sige, at bremserne er i orden, men synsmanden kører bilen op på rullefeltet og tjekker det selv."},"inPractice":{"en":"An internal auditor at a Danish region picks twenty staff who left last year and finds that four still have active accounts in the patient system; the report lists it as a finding with a deadline.","da":"En intern auditor i en region vælger tyve medarbejdere ud, der stoppede sidste år, og finder, at fire stadig har aktive konti i patientsystemet; rapporten angiver det som et fund med en frist."},"whyItMatters":{"en":"Written rules slowly drift away from what people actually do; without a regular, independent check, nobody notices until an incident or a customer exposes the gap.","da":"Skrevne regler og den daglige praksis glider langsomt fra hinanden; uden en fast, uafhængig kontrol opdager ingen det, før en hændelse eller en kunde afslører hullet."}},"deepDive":{"en":"Audits are classified by who performs them. First-party audits are internal audits performed by or on behalf of the organisation itself; second-party audits are performed by a customer or other interested party on a supplier, often based on a contractual audit right such as GDPR Art. 28(3)(h); third-party audits are performed by an independent body, for example a certification body or an auditing firm issuing an assurance report. The general method for management-system audits is ISO 19011:2018, which sets seven principles (integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach) and describes managing an audit programme and conducting individual audits. ISO/IEC 27007 adds ISMS-specific guidance, and ISO/IEC TS 27008 covers the technical assessment of information security controls.\n\nISO/IEC 27001:2022 clause 9.2 requires internal audits at planned intervals to determine whether the ISMS conforms to the organisation's own requirements and to the standard, and whether it is effectively implemented and maintained. Clause 9.2.2 requires an audit programme with frequency, methods, responsibilities and reporting that take into account the importance of the processes and the results of previous audits, defined criteria and scope for each audit, auditors selected to ensure objectivity and impartiality, reporting of results to relevant management, and retained documented evidence. In practice objectivity means auditors do not audit their own work; small organisations often buy internal audit from an external consultant to meet this.\n\nAn audit compares audit evidence (records, configuration exports, system logs, interview statements, observation) against audit criteria (policy, standard clause, contract, law). Because full examination is rarely possible, auditors sample: for example, selecting leavers from the HR system and tracing whether accounts were disabled within the policy deadline. Findings are graded, typically as major nonconformity (absence or total breakdown of a required process), minor nonconformity (an isolated lapse), observation, or opportunity for improvement. Nonconformities feed clause 10.2 corrective action, which requires root-cause analysis and evaluation of effectiveness, not just a fix of the specific instance.\n\nSeveral neighbouring terms are often conflated with audits. A gap analysis is a pre-implementation comparison, usually by the organisation itself, without an evidence standard. A penetration test or vulnerability scan tests technical exposure, not conformity to criteria. An assurance report such as ISAE 3402, ISAE 3000 or SOC 2 is issued by an auditing firm under assurance standards and, in its type 2 form, covers the operating effectiveness of controls over a period rather than at a point in time; Danish data processors commonly provide ISAE 3000 reports on GDPR compliance. Supervisory audits are a further category: NIS2 Art. 32 lets authorities impose regular and targeted security audits on essential entities.","da":"Audits inddeles efter, hvem der udfører dem. Førstepartsaudits er interne audits udført af eller på vegne af organisationen selv; andenpartsaudits udføres af en kunde eller anden interessent hos en leverandør, ofte med hjemmel i en kontraktlig auditret som GDPR art. 28, stk. 3, litra h; tredjepartsaudits udføres af et uafhængigt organ, fx et certificeringsorgan eller et revisionsfirma, der afgiver en erklæring. Den generelle metode for audit af ledelsessystemer er ISO 19011:2018, som fastsætter syv principper (integritet, retvisende fremstilling, faglig omhu, fortrolighed, uafhængighed, evidensbaseret tilgang og risikobaseret tilgang) og beskriver styring af et auditprogram og gennemførelse af de enkelte audits. ISO/IEC 27007 tilføjer vejledning specifikt for ISMS, og ISO/IEC TS 27008 dækker teknisk vurdering af informationssikkerhedskontroller.\n\nISO/IEC 27001:2022 punkt 9.2 kræver interne audits med planlagte mellemrum for at fastslå, om ISMS'et lever op til organisationens egne krav og standarden, og om det er effektivt implementeret og vedligeholdt. Punkt 9.2.2 kræver et auditprogram med hyppighed, metoder, ansvar og rapportering, der tager højde for processernes betydning og resultaterne af tidligere audits, fastlagte kriterier og omfang for hver audit, auditorer udvalgt, så objektivitet og upartiskhed sikres, rapportering af resultaterne til relevant ledelse og opbevaret dokumentation. I praksis betyder objektivitet, at auditorer ikke auditerer deres eget arbejde; små organisationer køber derfor ofte den interne audit hos en ekstern konsulent.\n\nEn audit sammenholder auditbevis (registreringer, konfigurationsudtræk, systemlogs, interviewudsagn, observation) med auditkriterier (politik, standardkrav, kontrakt, lov). Da fuld gennemgang sjældent er mulig, arbejder auditor med stikprøver: fx udvælges fratrådte medarbejdere i HR-systemet, og det spores, om deres konti blev lukket inden for politikkens frist. Fund graderes typisk som større afvigelse (en påkrævet proces mangler eller er brudt helt sammen), mindre afvigelse (et enkeltstående svigt), observation eller forbedringsmulighed. Afvigelser føder korrigerende handlinger efter punkt 10.2, som kræver årsagsanalyse og vurdering af effekten, ikke blot rettelse af det konkrete tilfælde.\n\nFlere nabobegreber forveksles ofte med audit. En gap-analyse er en sammenligning før implementering, som regel foretaget af organisationen selv og uden krav til bevisførelse. En penetrationstest eller sårbarhedsscanning tester teknisk eksponering, ikke overensstemmelse med kriterier. En revisorerklæring som ISAE 3402, ISAE 3000 eller SOC 2 afgives af et revisionsfirma efter erklæringsstandarder og dækker i type 2-udgaven kontrollernes funktionalitet over en periode frem for på et tidspunkt; danske databehandlere leverer ofte ISAE 3000-erklæringer om GDPR-overholdelse. Tilsynsaudits er en særskilt kategori: NIS2 art. 32 giver myndighederne mulighed for at pålægge væsentlige enheder regelmæssige og målrettede sikkerhedsaudits."},"edges":[{"type":"requires","to":"security/security-policy","confidence":"high","strength":"normal"},{"type":"requires","to":"security/compliance","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/gap-analysis","why":{"en":"A gap analysis finds what is missing before you start; an audit checks whether what you claim to do is really done.","da":"En gap-analyse finder, hvad der mangler, før man går i gang; en audit kontrollerer, om det, man siger, man gør, faktisk bliver gjort."},"confidence":"high","strength":"primary"},{"type":"contrasts-with","to":"security/self-assessment","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/pdca","why":{"en":"Audits supply the evidence for the Check step of the improvement cycle.","da":"Audits leverer beviserne til Check-trinnet i forbedringscyklussen."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/supplier-management","why":{"en":"Organisations audit key suppliers, or read their audit reports, to check they keep their promises.","da":"Virksomheder auditerer vigtige leverandører eller læser deres auditrapporter for at tjekke, at de holder det, de lover."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"ai/explainability","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"ISO/IEC 27001:2022, Clause 9.2 (Internal audit)","tier":"standard","publisher":"ISO/IEC"}],"draft":true}