IT and security internal audit
Find the control failures before the external auditor does.
Independent testers check that your controls are designed well and actually operate. Clear findings, agreed actions and a follow-up that confirms the fix.
Audit committees, compliance leads and companies preparing for SOC 2, ISO 27001 or SOX IT controls.
app.resilientprivacy.com/grc/internal-audit
Simulated environment, real workflow.
Where AI lands in Internal Audit.
Optional AI controls audit: model inventory, change control for prompts and models, access to AI tooling and human oversight, tested like any ITGC.
How the audit runs
From audit plan to management letter.
- 01
Plan
A risk-based audit plan agreed with your audit committee or compliance lead.
Output: Audit plan
- 02
Walkthroughs
Confirm each control's design with the people who run it.
Output: Walkthrough notes
- 03
Test
Sample-based testing of operating effectiveness, documented to the standard external auditors expect.
Output: Test workpapers
- 04
Report
Findings rated by risk, with root cause and management action plans.
Output: Audit report
- 05
Follow up
Retest remediated controls and close findings with evidence.
Output: Closed findings
Deliverables
What you keep when we are done.
Documents and systems your team owns and runs, not a binder that goes stale.
- Risk-based internal audit plan
- Control walkthrough documentation
- Test workpapers with samples and evidence
- Findings report with management responses
- Follow-up testing and closure memo
- Audit committee summary
Typical timeline
Varies with scopePlan
Week 1
Scope, risk ranking, request list.
Fieldwork
Weeks 2–4
Walkthroughs and testing.
Report
Week 5
Draft findings, management responses, final report.
Follow-up
60–90 days later
Retest and closure.
FAQ
Straight answers.
Are you independent of our compliance work?
Internal audit is staffed by people who did not design or run the controls they test.
Does ISO 27001 require an internal audit?
Yes. Clause 9.2 requires a planned internal audit programme, and the certification body will ask to see it.
Can external auditors rely on your work?
Often, for walkthroughs and evidence. Whether they rely on testing is their call; we document to make that easy.
Can you run internal audit as an ongoing function?
Yes, as a co-sourced or fully outsourced function on an annual plan.
Find out how close you are to audit-ready.
A 30-minute readiness conversation with a Risk & Compliance lead, scoped to the frameworks you are asked for.