Cyber Security Audit Course

Lesson 1 • Roles and Responsibilities in an Audit

Maps stakeholder roles: auditor, auditee, sponsor, and oversight body. Defines accountability structures that govern audit independence and objectivity.

Lesson 2 • Cybersecurity Audit vs. Related Disciplines

Differentiates auditing from penetration testing, risk assessment, and governance reviews. Clarifies when each discipline applies and how they interact.

Lesson 3 • Core Concepts and Audit Terminology

Establishes shared vocabulary: risk, threat, vulnerability, control, and assurance. Provides the conceptual baseline for all subsequent audit activities.

Lesson 1 • Regulatory and Industry Compliance Requirements

Examines sector-specific compliance obligations such as data protection, financial security, and critical infrastructure standards. Links compliance to audit scope definition.

Lesson 2 • Overview of Cybersecurity Frameworks

Surveys widely adopted control frameworks and their structural components. Provides context for selecting and applying frameworks during an audit engagement.

Lesson 3 • Audit Scope Definition Using Frameworks

Demonstrates how framework domains guide scope decisions and boundary setting. Ensures audit coverage is defensible and aligned with organisational risk priorities.

Lesson 1 • Developing the Audit Programme

Translates risk assessment outputs into a detailed audit programme with specific procedures and test steps. Ensures complete coverage of high-risk areas.

Lesson 2 • Conducting a Pre-Audit Risk Assessment

Guides auditors through information-gathering and preliminary risk identification before fieldwork begins. Produces a risk register that shapes the audit programme.

Lesson 3 • Risk-Based Audit Methodology

Introduces risk-based planning as the foundation for prioritising audit effort. Connects organisational risk appetite to audit focus areas and resource decisions.

Lesson 4 • Audit Scheduling and Resource Planning

Covers timeline construction, team role assignment, and coordination with auditee stakeholders. Produces a realistic, approved audit schedule.

Lesson 1 • Document Review and Artifact Analysis

Teaches systematic review of policies, procedures, logs, and configuration records. Links document analysis to control effectiveness conclusions.

Lesson 2 • Audit Workpaper Standards

Establishes workpaper structure, indexing, and cross-referencing requirements. Ensures workpapers are complete, clear, and reviewable by a qualified third party.

Lesson 3 • Chain of Custody and Evidence Integrity

Addresses procedures for maintaining evidence integrity from collection through reporting. Prevents evidence tampering challenges that could invalidate audit findings.

Lesson 4 • Types and Quality of Audit Evidence

Defines evidence categories—physical, testimonial, documentary, and analytical—and evaluates their reliability. Establishes quality criteria that determine evidentiary weight.

Lesson 1 • Identity and Access Management Auditing

Evaluates user provisioning, authentication strength, privilege management, and access review processes. Identifies excessive access and segregation-of-duties violations.

Lesson 2 • Application Security Control Testing

Tests input validation, authentication, session management, and error handling in applications. Links application weaknesses to business risk and data exposure.

Lesson 3 • Cryptography and Data Protection Testing

Evaluates encryption implementation, key management practices, and data-at-rest and in-transit protections. Identifies cryptographic weaknesses that expose sensitive data.

Lesson 4 • Endpoint and System Hardening Review

Assesses patch management, configuration baselines, and endpoint protection controls. Validates that systems meet hardening standards and are protected against known threats.

Lesson 1 • Third-Party and Vendor Risk Auditing

Evaluates vendor onboarding, contractual security requirements, ongoing monitoring, and offboarding controls. Addresses supply chain risk as an organisational exposure.

Lesson 2 • Change Management and Configuration Control

Audits change request, approval, testing, and rollback procedures for IT systems. Verifies that unauthorised changes are detected and controlled.

Lesson 3 • Security Awareness and Training Auditing

Evaluates training programme design, delivery, completion tracking, and effectiveness measurement. Links workforce awareness levels to social engineering and insider threat risk.

Lesson 4 • Security Policy and Procedure Review

Assesses policy completeness, currency, approval status, and alignment with organisational risk. Identifies policy gaps that leave operational controls unsupported.

Lesson 1 • Writing Clear and Actionable Recommendations

Teaches recommendation writing that is specific, measurable, and feasible. Connects each recommendation directly to the finding's root cause and risk impact.

Lesson 2 • Audit Report Structure and Content

Defines the components of a formal audit report: executive summary, scope, methodology, findings, and recommendations. Balances technical detail with executive readability.

Lesson 3 • Communicating Findings to Stakeholders

Covers techniques for presenting findings in exit conferences, executive briefings, and written reports. Addresses handling disagreements and management pushback professionally.

Lesson 4 • Developing Audit Findings

Structures findings using condition, criteria, cause, and effect components. Ensures each finding is evidence-supported, risk-rated, and linked to a specific control failure.

Lesson 1 • Continuous Auditing and Monitoring

Explores automated monitoring techniques that provide ongoing assurance between formal audits. Integrates continuous control monitoring into the audit strategy.

Lesson 2 • Control Maturity Measurement

Introduces maturity models to assess control capability levels over time. Tracks improvement trends and communicates maturity progress to leadership.

Lesson 3 • Follow-Up Audit Procedures

Defines when and how follow-up audits verify that remediation actions have been implemented effectively. Distinguishes full re-audit from targeted follow-up testing.

Lesson 4 • Remediation Planning and Ownership

Establishes processes for assigning remediation owners, setting deadlines, and tracking corrective action plans. Ensures accountability for closing identified control gaps.