Risk-based cyber audit planning

Start with the business outcomes to protect. At Harbor, a payment file must reach the bank with the correct beneficiary, amount and authorization. This relies on HR data, application roles, transfer processes, external banking channels and holiday delegation. A universe listing only IT departments misses those boundaries. Record a business owner, information type, critical dependencies and recent significant changes for each entry.

An entry need not be audited in the same year. Make the universe visible, then explain review timing. Separate unused services from active scope. When external reports or second-line reviews exist, record their period and risk coverage rather than assuming complete assurance. This prevents resource constraints from becoming invisible exclusions.

Related primary references: The IIA — Global Internal Audit Standards (2024) ↗NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments ↗

Consider three fictional candidates: a stable low-impact portal, a payment service moved to a new provider and a privileged-access process with missing evidence. Ranking only last year’s score hides new dependencies and unknowns. Consider business impact, failure or threat paths, control uncertainty, significant changes and prior findings. If numbers are used, document scale definitions, evidence and uncertainty; this example supplies no universal risk formula.

Harbor prioritizes the payment migration because the same change affects file production and approval. Deferring the portal records an owner, rationale and reconsideration trigger. An incident, new data flow or insufficient evidence can change the plan. Use a change record and authorized review rather than arbitrary daily changes, and keep excluded high-impact areas visible.

Related primary references: NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments ↗

An auditor may advise on design, but owning management decisions or operating a control can affect later assurance. If the same team implemented Harbor’s approval matrix last month, disclose that before the engagement. An internal-audit label does not prove objectivity. Appropriate oversight, another assessor or a revised engagement is determined under the applicable professional framework and organizational mandate.

Management operates controls and manages business risk; audit evaluates evidence and communicates conclusions to authorized recipients. Reporting a risk does not accept it on the business’s behalf. Record specialist needs and limitations rather than silently narrowing objectives. External specialists still require planned access, confidentiality, scope and review of their results.

Related primary references: The IIA — Global Internal Audit Standards (2024) ↗

Is security adequate is not a testable question on its own. Harbor asks whether, during a defined period, a production payment-file preparer could approve that same file alone. Criteria include the organization’s authorized segregation rule and applicable service contract conditions. Specify period, application version, user groups and delegation path. Naming a law or standard alone does not identify the applicable requirement.

If bank-internal controls are excluded, do not extend conclusions to the whole bank. Preserve an inaccessible legacy period as a reporting limitation. Clarify scope and criteria with management without redefining them to hide observed exceptions. Resolve disputes by checking which version applied at the time and escalating unresolved issues to authorized oversight.

Related primary references: ISO 19011:2026 — Guidelines for auditing management systems ↗NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls ↗

The work program explains which evidence is needed for each question. Harbor’s segregation question may require configuration examination, interviews and a controlled non-production test that one person cannot perform both steps. These are different claims: an interview describes a process, configuration shows design at a point in time and a test observes behavior under defined conditions. Period-wide operation also requires event and transaction records.

Do not pre-assume a positive result. Record expected behavior, failure indicators, sources and reproducibility. Establish sampling limits in the evidence guide. Reusing one screenshot across many controls does not broaden assurance unless it supports each claim. Unauthorized production changes or real payment attempts are outside this teaching exercise.

Related primary references: NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls ↗NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment ↗

The fictional application team can share current roles but cannot retrieve historic approvals. That does not establish period-wide segregation. Explore alternative records, retention information or controlled queries. Missing evidence alone also does not prove a failed control: record inability to conclude and the scope limitation separately. Escalate barriers to necessary information through authorized audit oversight.

Before starting, ensure least-privilege, time-bound and traceable access. Do not upload transaction files to the teaching page; reference evidence held in controlled organizational storage. Minimize customer or employee fields not needed for the test. If masking obscures the tested property, redesign the method and controlled access rather than inventing missing evidence.

Related primary references: The IIA — Global Internal Audit Standards (2024) ↗NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment ↗

A ready engagement combines risk rationale, scope and objective, criteria references, resources, timing, objectivity arrangements, work program and communication paths. Harbor then proceeds to population reconciliation in the evidence guide. Approval of the plan authorizes how work will proceed; it does not conclude that controls work.

If a dependency emerges, identify the affected question and additional evidence needed. When time is insufficient, make remaining scope, effects and authorized decisions visible instead of quietly reducing tests. Reuse the engagement ID across the plan, evidence and any finding/retest. Traceability demonstrates an intact reasoning chain, not elimination of every risk.

Related primary references: ISO 19011:2026 — Guidelines for auditing management systems ↗The IIA — Global Internal Audit Standards (2024) ↗