6.5.1. Internal and External Audits
💡 First Principle: Internal audits assess your own controls. External audits provide independent validation. Both are necessary — internal audits catch issues early through continuous self-assessment, and external audits provide the credibility and independence that internal assessments lack. Think of internal audits as self-inspection and external audits as independent certification.
Internal audits — conducted by the organization's audit team or internal security assessors. Assess compliance with internal policies, effectiveness of controls, and operational procedures. Advantage: deeper knowledge of the environment and business context, can audit more frequently, lower cost. Disadvantage: potential bias and lack of independence. Internal auditors should report to an independent function (audit committee, board) rather than to the teams they're auditing.
External audits — conducted by independent third parties. Provide objective assessment and formal attestation. Required for many compliance frameworks (PCI DSS requires a Qualified Security Assessor, SOC 2 requires a CPA firm, ISO 27001 requires an accredited certifier). Advantage: credibility, independence, and stakeholder trust. Disadvantage: higher cost, limited environmental knowledge, and they see a point-in-time snapshot rather than ongoing operations.
Assessment types:
- Compliance assessment — evaluates the organization against specific regulatory or framework requirements (HIPAA, PCI DSS, NIST 800-171)
- Attestation — formal statement that controls meet defined criteria. SOC 2 Type II reports are a common example — a CPA firm attests that controls operated effectively over a period (typically 12 months)
Regulatory examinations — formal assessments conducted by regulatory bodies (FDIC, OCC for banks; HHS for HIPAA) with legal authority to enforce findings. Unlike voluntary audits, regulatory examinations are mandatory and findings may result in enforcement actions.
⚠️ Exam Trap: Internal audits and external audits serve different purposes. Internal = ongoing self-improvement and early detection. External = independent validation for stakeholders. If a question asks who should audit PCI DSS compliance, it's a Qualified Security Assessor (external), not the internal team. (Nuance: where a full on-site assessment is required, card brands such as Mastercard allow it to be done in house only by staff the PCI Security Standards Council has certified as Internal Security Assessors (ISAs); an uncertified internal team's audit does not count. Smaller merchants validate with a Self-Assessment Questionnaire instead.)
