What is an audit? The complete guide for organisations

Audits are a standard part of compliance, certification and risk management. Yet in many organisations, the term is still associated with stress, paperwork and external inspectors. That misses the point. A well-run audit is not a threat, but a structured way of finding out whether what you think is happening is actually happening. This guide explains what audits are, what types exist, and what they mean for your organisation’s security posture.

What is an audit?

An audit is a systematic, independent examination of processes, systems, documents or behaviour against a defined standard or set of requirements. The goal is to establish whether reality matches the norm, and where it does not, to understand why.

Audits are used across many domains: financial auditing checks whether accounts accurately reflect a company’s position, IT audits examine whether systems meet security or performance standards, and compliance audits verify whether an organisation meets legal or regulatory obligations. In the context of cybersecurity and information security, the term most often refers to audits against frameworks such as ISO 27001, NEN 7510, or directives such as NIS2.

What is an internal audit?

An internal audit is conducted by people within the organisation, or by a team that reports to the organisation’s own management. The auditors are not part of the process they are examining, but they are not external to the company either.

The purpose of an internal audit is to give management an independent view of whether the organisation’s own procedures and controls are working as intended. In information security, internal audits are often used to prepare for external certification audits, so that gaps are identified before an external party finds them. ISO 27001, for instance, explicitly requires organisations to conduct internal audits as part of their information security management system (ISMS).

Internal audits follow a repeating cycle: plan, execute, report, follow up. The results are typically shared with management and used to drive improvements, not to assign blame.

What does an internal auditor do?

An internal auditor plans and executes audit activities within the organisation. In practice, that means reviewing documentation, interviewing staff, observing processes and testing controls to determine whether they function as described.

An internal auditor working in information security typically focuses on areas such as access control, incident management, data handling, supplier relationships and security training. They produce an audit report that identifies findings, both gaps and areas of good practice, and makes recommendations for corrective action.

The role requires a combination of technical understanding, communication skills and independence. An internal auditor must be able to ask the right questions, evaluate evidence critically, and report findings in a way that management can act on.

What is an external audit?

An external audit is conducted by an independent party outside the organisation. External audits are required for formal certification (such as ISO 27001), for regulatory compliance checks, or when an organisation wants an objective, third-party view of its controls.

In ISO 27001 certification, the external audit happens in two stages. The first stage reviews documentation and checks whether the ISMS is ready for full assessment. The second stage is an on-site audit where auditors verify that the management system is actually working in practice. If the organisation passes, it receives certification. That certification is then maintained through annual surveillance audits and renewed every three years.

External audits tend to carry more weight with clients, regulators and partners than internal audits, precisely because they are independent. That is also why preparation matters: an organisation that has a well-functioning internal audit programme is significantly better placed going into an external audit.

Why audits always end up at people

Technical controls and documented procedures are important, but auditors consistently find that human behaviour is where things go wrong. Policies that are written but not followed. Training that is completed but not retained. Procedures that exist on paper but are bypassed in practice.

This is why security awareness training has become a standard element in audits for both NIS2 and ISO 27001. Auditors do not just want to see that training was scheduled. They want evidence that employees actually understand the risks they face and that the organisation can demonstrate ongoing awareness efforts.

Guardey provides that evidence. The platform tracks training completion, phishing simulation results and awareness progress over time, giving organisations the documentation they need to show auditors that security awareness is an active, measurable programme rather than a checkbox.