# Risk-based cyber audit planning Audit value depends on the evidence supporting an important decision, rather than the number of questions asked. Using the fictional Harbor payment service, this guide moves from an audit universe to an authorized work program. Two companion guides continue with evidence and finding closure. The workflows are original teaching examples, not an organization’s audit mandate, legal assessment or certification decision. Original SecNet educational content with fictional examples, not publication/endorsement by referenced organizations. Page exercise choices last only for the open session; no real organizational data is collected. 2026.10 · 2026-10-23 ## What should I do tomorrow? 1. Map one critical service and its assurance gap. 2. Give one audit question criteria, a period and a test path. 3. Clarify objectivity and evidence escalation before work starts. ## Concepts **Denetim evreni** — An owned map of services, processes, systems and dependencies that could be reviewed. **Denetim amacı** — The decision or question the engagement will address with evidence. **Ölçüt / kriter** — The applicable, defined expectation against which observations are compared. **Kapsam sınırlaması** — Inability to access the period, evidence or resources needed for the objective. **Bağımsızlık** — Positioning and arrangements that protect assurance judgments from management of the reviewed activity. **Güvence boşluğu** — An important risk not explicitly addressed by existing assessments. ## Process map ### 1. Map the universe Audit lead + business owners Connect services, risks and existing assurance. Owned audit universe. ### 2. Justify priorities Audit lead Consider impact, change and uncertainty together. Justified, reviewed plan. ### 3. Bound objective and scope Engagement lead Record questions, criteria, period and exclusions. Authorized engagement scope. ### 4. Design the work program Audit team Specify methods, evidence and safe tests for each question. Question-test-evidence mapping. ### 5. Validate readiness Engagement lead + authorized oversight Check independence, competence, access and changing risk. Proceed or rescope decision. ## Make the audit universe broader than the organization chart Start with the business outcomes to protect. At Harbor, a payment file must reach the bank with the correct beneficiary, amount and authorization. This relies on HR data, application roles, transfer processes, external banking channels and holiday delegation. A universe listing only IT departments misses those boundaries. Record a business owner, information type, critical dependencies and recent significant changes for each entry. An entry need not be audited in the same year. Make the universe visible, then explain review timing. Separate unused services from active scope. When external reports or second-line reviews exist, record their period and risk coverage rather than assuming complete assurance. This prevents resource constraints from becoming invisible exclusions. - [ ] Universe entries include service, owner, dependencies and existing assurance. Reference: [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/), [NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments](https://csrc.nist.gov/pubs/sp/800/30/r1/final) ## Show decision rationale instead of a magic score Consider three fictional candidates: a stable low-impact portal, a payment service moved to a new provider and a privileged-access process with missing evidence. Ranking only last year’s score hides new dependencies and unknowns. Consider business impact, failure or threat paths, control uncertainty, significant changes and prior findings. If numbers are used, document scale definitions, evidence and uncertainty; this example supplies no universal risk formula. Harbor prioritizes the payment migration because the same change affects file production and approval. Deferring the portal records an owner, rationale and reconsideration trigger. An incident, new data flow or insufficient evidence can change the plan. Use a change record and authorized review rather than arbitrary daily changes, and keep excluded high-impact areas visible. - [ ] Priority and deferral rationales include uncertainty and reassessment triggers. Reference: [NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments](https://csrc.nist.gov/pubs/sp/800/30/r1/final) ## Separate advice, control ownership and independent assurance An auditor may advise on design, but owning management decisions or operating a control can affect later assurance. If the same team implemented Harbor’s approval matrix last month, disclose that before the engagement. An internal-audit label does not prove objectivity. Appropriate oversight, another assessor or a revised engagement is determined under the applicable professional framework and organizational mandate. Management operates controls and manages business risk; audit evaluates evidence and communicates conclusions to authorized recipients. Reporting a risk does not accept it on the business’s behalf. Record specialist needs and limitations rather than silently narrowing objectives. External specialists still require planned access, confidentiality, scope and review of their results. - [ ] Prior control involvement, conflicts and specialist needs have been assessed. Reference: [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/) ## Turn an objective into testable questions Is security adequate is not a testable question on its own. Harbor asks whether, during a defined period, a production payment-file preparer could approve that same file alone. Criteria include the organization’s authorized segregation rule and applicable service contract conditions. Specify period, application version, user groups and delegation path. Naming a law or standard alone does not identify the applicable requirement. If bank-internal controls are excluded, do not extend conclusions to the whole bank. Preserve an inaccessible legacy period as a reporting limitation. Clarify scope and criteria with management without redefining them to hide observed exceptions. Resolve disputes by checking which version applied at the time and escalating unresolved issues to authorized oversight. Original Harbor question refinement | Vague statement | Testable question | Boundary | | --- | --- | --- | | Are permissions secure? | Can a preparer approve the same file? | Defined period and delegation path | | Is the supplier compliant? | Which service requirement has which evidence? | Service and contract scope | | Is recovery complete? | Did a representative payment path pass acceptance? | Test conditions and external dependencies | - [ ] Objective, question, criterion version, period and exclusions share one record. Reference: [ISO 19011:2026 — Guidelines for auditing management systems](https://www.iso.org/standard/19011), [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final) ## Connect the question, method and evidence The work program explains which evidence is needed for each question. Harbor’s segregation question may require configuration examination, interviews and a controlled non-production test that one person cannot perform both steps. These are different claims: an interview describes a process, configuration shows design at a point in time and a test observes behavior under defined conditions. Period-wide operation also requires event and transaction records. Do not pre-assume a positive result. Record expected behavior, failure indicators, sources and reproducibility. Establish sampling limits in the evidence guide. Reusing one screenshot across many controls does not broaden assurance unless it supports each claim. Unauthorized production changes or real payment attempts are outside this teaching exercise. - [ ] Each question has a method, expected behavior, evidence and limitations. Reference: [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final), [NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) ## An access limitation is not a control success The fictional application team can share current roles but cannot retrieve historic approvals. That does not establish period-wide segregation. Explore alternative records, retention information or controlled queries. Missing evidence alone also does not prove a failed control: record inability to conclude and the scope limitation separately. Escalate barriers to necessary information through authorized audit oversight. Before starting, ensure least-privilege, time-bound and traceable access. Do not upload transaction files to the teaching page; reference evidence held in controlled organizational storage. Minimize customer or employee fields not needed for the test. If masking obscures the tested property, redesign the method and controlled access rather than inventing missing evidence. - [ ] Evidence access, minimization and scope-limitation escalation are ready. Reference: [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/), [NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) ## The plan produces an executable engagement, not a conclusion A ready engagement combines risk rationale, scope and objective, criteria references, resources, timing, objectivity arrangements, work program and communication paths. Harbor then proceeds to population reconciliation in the evidence guide. Approval of the plan authorizes how work will proceed; it does not conclude that controls work. If a dependency emerges, identify the affected question and additional evidence needed. When time is insufficient, make remaining scope, effects and authorized decisions visible instead of quietly reducing tests. Reuse the engagement ID across the plan, evidence and any finding/retest. Traceability demonstrates an intact reasoning chain, not elimination of every risk. - [ ] The engagement ID carries into evidence and finding records. Reference: [ISO 19011:2026 — Guidelines for auditing management systems](https://www.iso.org/standard/19011), [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/) ## Common mistakes and better approaches **Every area uses the same checklist.** — Service risk and the decision question determine the method. **Plan approval means positive assurance.** — The plan only authorizes the work to be performed. **Unavailable evidence means the control passed.** — Make conclusion limits and alternative evidence needs visible. ## Decision examples and explained answers ### Old score or new change? Harbor’s portal had a high score last year. This year the payment provider and approval workflow changed without operating evidence. Capacity allows one engagement. **Reuse the previous ranking unchanged.** — Revisit The old score does not explain the new failure path or assurance gap. The portal should not be automatically deferred either: compare current impact and evidence before deciding. **Assess change and uncertainty, then record the priority decision.** — Supported approach Comparing current scope and impact supports a justified decision. Documenting deferrals and reconsideration triggers keeps capacity constraints visible rather than implying complete coverage. ### A control you designed The proposed auditor designed and implemented the payment approval rule last month. Independent assurance is now requested. **Let that auditor assess it alone because they know it best.** — Revisit Technical knowledge helps but does not resolve objectivity concerns when reviewing one’s own management decisions. The issue is the assurance arrangement, not an accusation of dishonesty. **Disclose prior responsibility and arrange appropriate independent assessment.** — Supported approach Disclosure and suitable arrangements allow expertise to help while protecting independent judgment. Record the decision under the mandate and applicable professional framework. ### An unseen period Current roles look correct, but three months of legacy approvals cannot be retrieved. The engagement covers the year. **Conclude positively for the year using the current screen.** — Revisit Current configuration does not prove historical operation. A positive year-wide conclusion exceeds observed coverage and may mislead the report recipient. **Seek alternatives and disclose the unresolved period limitation.** — Supported approach Exploring alternatives and disclosing residual limits preserves both evidence and uncertainty. Address the issue through authorized oversight without equating missing evidence automatically with failure. ## Official references - [ISO 19011:2026 — Guidelines for auditing management systems](https://www.iso.org/standard/19011) — Official scope and edition record for the May 2026 guidance standard. This package does not reproduce its text or a licensed checklist; ISO 19011 is not itself a certification standard. - [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/) — Official entry point for professional standards effective 9 January 2025. These original workpapers are not an IIA publication, authorization or professional credential. - [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final) — Reference for control-assessment methods; the publication page’s 2025 Release 5.2.0 update was also checked. Examples are not a NIST assessment or automated compliance decision. - [NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments](https://csrc.nist.gov/pubs/sp/800/30/r1/final) — Risk-assessment context; example priorities and decision scales are fictional SecNet choices, not universal thresholds. - [NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) — Dated foundational reference for planning, authorization boundaries and analysis of technical assessments. Historical tool examples are not treated as current tool recommendations.