Introduction

An audit of GRC involves the validation of the effectiveness of the GRC program through which the organization has defined its processes. This is done to verify whether the policies developed by the organization are being effectively implemented. The following is how these audits are conducted.

Why GRC Audits Exist

The presence of policies and controls does not necessarily mean they are being followed on an everyday basis. The audit process aims precisely to identify the difference between what is said to happen and what happens by assessing whether there are controls in place and if risk assessments are up-to-date and accurate.

It is important both for internal purposes (the leadership should know how things are really going in the company) and because of outside requirements (in many cases, regulators, customers and partners need audit evidence).

Internal vs. External GRC Audits

Internal Audits

Internal Audits are carried out internally by the internal audit department of the organization (or an outside consultant performing this task for them) and generally take place more often and are concerned with the verification of the effectiveness of control measures on a regular basis.

External Audits

Usually conducted by independent third parties who act as auditors, often necessary when seeking certifications such as SOC 2, or ISO 27001 or regulatory compliance such as SOX, certain financial and healthcare regulations. The importance of an external audit is due to its independence from the company under assessment.

What a Typical GRC Audit Process Looks Like

1. Scoping

Determining the frameworks, systems, or business units included within the scope of the audit.

2. Planning

Specifying the control requirements and evidence to be reviewed for each control.

3. Evidence Collection

Collecting any documents, logs, and other evidence showing that the controls are operating effectively.

4. Testing

Controls can be verified directly by auditors, either by reviewing the documentation or observing the controls.

5. Findings

Identification of any weaknesses in controls or lack of compliance that have been noted through testing.

6. Reporting

Preparation of a final audit report for submission to appropriate parties according to the objective of the audit.

7. Remediation

Closing gaps through a follow-up audit (or follow-up plan), where necessary to ensure remediation had occurred.

Common Types of GRC Audits by Purpose

• SOC 2 audit: often performed on a technology company to demonstrate security policies to enterprise customers
• ISO 27001 certification audit: to verify that an information security management system meets the requirements of the standard
• SOX audit: mandatory for all public companies to verify the internal controls of financial reporting
• Regulatory compliance audit: specific to certain industries, such as healthcare (HIPAA) or financial services
• Risk audit: to verify that risk assessments and mitigations performed internally have been accurately documented

Preparing for a GRC Audit

Organizations that have been prepared tend to:

• Collect evidence continuously throughout the year as opposed to waiting until the audit is about to happen, which is one of the key reasons why organizations use GRC or compliance automation software
• Conduct readiness checks internally prior to the official external audit, finding and resolving gaps before they occur
• Keep policies up-to-date and realistic instead of old and out-of-date policies
• Define who owns the internal controls, ensuring that any request for evidence is answered in a timely manner

The Role of GRC Software in Audit Readiness

One of the most difficult steps involved in the GRC auditing process is the collection of evidence manually from multiple disjoined systems in order to collect logs, screenshots, and documentation. Using special software such as GRC and compliance automation tool (for example, Vanta, Drata, ServiceNow GRC) will help to automate a great part of this evidence collection.

Common Mistakes That Complicate GRC Audits

• Procrastination until close to the audit date for evidence collection, instead of being continuously ready
• Documentation that doesn’t reflect what actually happens, leading to findings which should have been prevented through better coordination within
• Lack of clear responsibility for certain control activities, causing delays in evidence acquisition during the course of the audit
• Handling audit findings as a one-off solution, instead of fixing underlying issues that might appear in future audits

Bottom Line

The function of the GRC audit is to validate whether the GRC process implemented by the organization is truly based on actual practice rather than simply the content of its policies. It is evident that firms with continuous data collection and up-to-date documentation are likely to go through the auditing process much easier than those who treat audit preparation as a yearly panic.