6.5.1. Internal and External Audits

💡 First Principle: Internal audits assess your own controls. External audits provide independent validation. Both are necessary — internal audits catch issues early through continuous self-assessment, and external audits provide the credibility and independence that internal assessments lack. Think of internal audits as self-inspection and external audits as independent certification.

Internal audits — conducted by the organization's audit team or internal security assessors. Assess compliance with internal policies, effectiveness of controls, and operational procedures. Advantage: deeper knowledge of the environment and business context, can audit more frequently, lower cost. Disadvantage: potential bias and lack of independence. Internal auditors should report to an independent function (audit committee, board) rather than to the teams they're auditing.

External audits — conducted by independent third parties. Provide objective assessment and formal attestation. Required for many compliance frameworks (PCI DSS requires a Qualified Security Assessor, SOC 2 requires a CPA firm, ISO 27001 requires an accredited certifier). Advantage: credibility, independence, and stakeholder trust. Disadvantage: higher cost, limited environmental knowledge, and they see a point-in-time snapshot rather than ongoing operations.

Assessment types:

• Compliance assessment — evaluates the organization against specific regulatory or framework requirements (HIPAA, PCI DSS, NIST 800-171)
• Attestation — formal statement that controls meet defined criteria. SOC 2 Type II reports are a common example — a CPA firm attests that controls operated effectively over a period (typically 12 months)

Regulatory examinations — formal assessments conducted by regulatory bodies (FDIC, OCC for banks; HHS for HIPAA) with legal authority to enforce findings. Unlike voluntary audits, regulatory examinations are mandatory and findings may result in enforcement actions.

⚠️ Exam Trap: Internal audits and external audits serve different purposes. Internal = ongoing self-improvement and early detection. External = independent validation for stakeholders. If a question asks who should audit PCI DSS compliance, it's a Qualified Security Assessor (external), not the internal team.