The Audit Readiness Episode

Where do you start with an audit?: The process typically begins when an organization is required by one of its clients to get audited. The first step for the organization is to understand its own environment: its systems, software, and inventory of what needs to be protected. This is an all-encompassing process that includes physical security, software, data, and even the people within the company.

What do companies want to know about audits?:

• Companies often start with fundamental questions like, “What is a SOC 2?” or “What is PCI?” They may not even understand what their client is requesting and need guidance on where to begin.

• Audits are needed across all industries, including healthcare, manufacturing, software development, banking, and finance. There is a compliance framework for nearly every sector.

• Small and medium-sized businesses often mistakenly believe they are too small to be a target for cyberattacks. In reality, they are often the primary targets, and a breach can be devastating due to loss of revenue and reputation.

What problems have you encountered?: A common issue is that while an IT department may be implementing appropriate cybersecurity measures, they often lack the formal policies and procedures to document them. In other cases, companies may not have best security practices in place at all, leaving them vulnerable. For example, some organizations have been found with unencrypted client information that could be exposed to the internet.

How do you start an audit?: The process begins by gathering baseline information, such as discussing critical third parties, vendors, and whether the company is cloud-based or self-hosted. This is followed by a kickoff call to discuss the successes of previous clients and outline the audit process. The goal is to act as a partner to guide the company, especially through its first audit.

Success stories: The most rewarding experiences involve returning to a company for a subsequent audit and seeing a complete transformation in their culture of security and compliance. After the first audit, they move from being vulnerable and unprepared to being excited about finding new opportunities for improvement and are proud to show off the great work they’ve done.