The auditor who owns the firewall
Atlas Health Services runs a 90-person internal audit function for a 4,000-employee health insurer. The 12-month audit programme contains 14 audits. The auditor assigned to 'Network security and access control' is the IT operations manager, who approves firewall changes and holds domain administrator rights; he audits that area because he is the only CISA in the team. Two of the 14 audits were cancelled for resource reasons and replaced by desk reviews of policies. The programme was built from last year's schedule without a risk assessment. Audit working papers use a 2019 checklist with clause references to ISO/IEC 27001:2013, and none of the auditors have records of continuing professional development. One report on the claims platform states 'no findings' although the incident log shows 11 severity-1 incidents in the period and the problem management register lists the same root cause four times.
1. Evaluate the independence, objectivity and competence of the internal audit activity. What immediate action would you take on the network security audit?
Read the worked answer
The IT operations manager auditing firewall changes and access control is a self-review threat. He has operational responsibility for the very controls under review, so he cannot provide independent assurance on them. Technical knowledge is not a substitute for objectivity. The internal audit activity may sit within the organisation, but individual auditors must be free from bias and conflicting responsibilities; the audit charter and assignment process should prevent this. The absence of CPD records also weakens competence evidence: a CISA certification shows foundation knowledge, not current competence against the 2022 standard or the organisation's technology.
Immediate action: do not rely on that audit. Reassign the engagement to an auditor without operational responsibility, supported by a technical specialist who can be interviewed for evidence but does not direct the conclusion. If no independent resource exists, co-source or arrange a peer review. Review the working papers already produced for sufficiency and independence. Record a finding against the audit programme's independence arrangements and escalate to the audit committee, because the same conflict may affect other assignments.
2. Assess whether the audit programme and reporting are risk-based, reliable and aligned with current audit criteria. Recommend remedial actions.
Read the worked answer
The programme is not risk-based: it repeats last year's schedule and has no documented risk assessment linking audit topics, frequency and depth to the organisation's information security risks. Replacing cancelled audits with policy desk reviews changes scope without a documented rationale; a desk review cannot test whether network access controls operate. The 2019 checklist refers to ISO/IEC 27001:2013, so the criteria are outdated against the 2022 revision, including the restructured Annex A and new control areas. The 'no findings' report is not a fair presentation if 11 severity-1 incidents and a repeated root cause existed; the audit either did not examine incident and problem records or did not report what it found.
Remedial actions: rebuild the programme from a documented risk assessment, with scope, criteria, duration and competence needs for each audit; create a competence matrix and CPD plan; require annual independence declarations and exclude auditors from areas they manage; update audit criteria and checklists to the current standard and regulatory requirements; review the claims platform working papers and re-perform the audit; and report the programme weaknesses to the audit committee with an owner and due date.