Compliance Audit

A compliance audit checks whether your organization meets the laws, regulations and standards that apply to it. We carry it out as an independent internal audit or readiness assessment, so you find the gaps before a certification body, regulator or major customer does. In regulated sectors such as banking, healthcare, telco and government, failing the real audit can mean fines, lost contracts and damaged trust.

When organizations call us

The usual trigger is a date in the diary: an ISO/IEC 27001 certification or surveillance audit, a PCI DSS assessment, a SOC 2 examination or a regulator’s inspection. Others come to us before entering a new market, or when a large customer sends a security review.

Data protection law is a frequent driver. An organization handling personal data of people in the EU must be able to show it complies with the General Data Protection Regulation (GDPR). Organizations in Indonesia must meet the Personal Data Protection Law (UU PDP, Law No. 27 of 2022).

Which standards can you audit against?

  • ISO/IEC 27001:2022, the international standard for information security management, covering its clauses and Annex A controls.
  • PCI DSS, the card payment industry’s security standard, as preparation for an assessment by a Qualified Security Assessor (QSA) or for a self-assessment.
  • SOC 2, as preparation for a CPA firm’s examination against the Trust Services Criteria.
  • GDPR and UU PDP, covering data protection governance, records of processing, data protection impact assessments (DPIA) and breach notification.
  • NIST CSF, the US cybersecurity framework, as a maturity baseline across Identify, Protect, Detect, Respond and Recover.

What the audit team actually does

We start by agreeing the frameworks, legal entities, systems and processes in scope. We read your policies, procedures, risk assessments and previous audit results. Then we interview the people who run the controls and walk through how the work is really done.

Documents only tell part of the story, so we also test evidence. We take samples of records, system settings and logs to confirm that each control operates as written. Every gap is rated by risk and by the effort needed to close it. We present the findings and, before your external audit, check that the priority gaps have been closed.

What you receive

  • A gap report, control by control, with references to the evidence reviewed.
  • A remediation roadmap ranked by risk, with owners and priorities.
  • An executive summary for management and the board.
  • A follow-up review confirming that priority gaps are closed.

One point is worth being clear on. Certificates are issued by accredited certification bodies, QSAs or CPA firms, not by us. Our role is to make sure you are ready when they arrive.

Request a compliance audit proposal to scope your assessment.