Audit

What is an audit?

An audit is a systematic, independent and documented examination in which an auditor collects and evaluates objective evidence to determine the extent to which processes, systems, documents or products meet predefined criteria, such as standards, legislation or internal policies. This follows the definition in ISO 19011, the international guideline for auditing management systems. Audits are carried out in IT and OT environments, and also for quality, safety and compliance, to manage risk, demonstrate reliability and meet regulatory requirements.

🧾 What types of audits are there?

ISO 19011 distinguishes three parties that can carry out an audit. Audits also differ in subject and method.

🔄 What is the difference between a process audit and a technical audit?

A process audit assesses whether policies, procedures and records exist and are followed. The auditor takes samples: for example, requesting ten recent changes and checking that each was approved through Change Management. A technical audit focuses on cybersecurity and looks at the actual configuration of systems: firewall rules, accounts, patch levels and network connections.

A penetration test and vulnerability scanning are strictly speaking not audits but technical tests. They do, however, often provide the evidence an audit relies on. An audit therefore asks not only “was a pentest carried out?” but also “were the findings followed up, and is that recorded?“.

🧠 What is checked during an IT/OT audit?

• Policies and procedures — for example Change Management, Incident Management and patch management
• Logs and audit trails — whether logging is enabled, stored centrally (for instance in a SIEM) and actually reviewed
• Documentation and versioning — up-to-date drawings, network diagrams and version control of PLC programs
• Access and permission management — IAM, RBAC, shared accounts and supplier remote access
• Assets and configuration — a complete asset inventory and CMDB
• Backups and disaster recovery — whether restores have actually been tested
• Physical and digital security — locked cabinets, control rooms and network segmentation
• Calibrations, validations and GxP compliance — in regulated sectors such as pharmaceuticals and food

🔧 How does an audit work step by step?

ISO 19011 describes a fixed sequence of audit activities that is also used in ISMS, quality and OT audits:

Findings are usually given one of these classifications:

• Major nonconformity — a requirement is not met at all, or systematically not met; in certification this blocks the certificate until the certification body has accepted the correction and corrective actions
• Minor nonconformity — an isolated deviation that does not undermine the system as a whole
• Observation — a risk that is not yet a deviation but could become one
• Opportunity for improvement — a suggestion without obligation

Follow-up is part of the PDCA cycle: in ISO 27001, clause 10.2 ensures that nonconformities are corrected and their root cause is addressed.

📜 Which standards and laws cover audits?

The seven principles of ISO 19011 are integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. The last principle was added in the 2018 edition. The fourth edition, ISO 19011:2026, was published in May 2026 and replaces the 2018 version. The principles are unchanged, but remote and hybrid audits are now treated as fully valid alongside on-site visits, and auditors are also expected to have ICT competence.

An ISO 27001 certificate is valid for three years. The process starts with a stage 1 audit (documentation and readiness) and a stage 2 audit (implementation in practice), followed by annual surveillance audits and recertification in the third year. Certificates based on the old 2013 version have no longer been valid since 31 October 2025. In the Netherlands, certification bodies are accredited by the Dutch Accreditation Council (RvA).

🏭 How does an OT audit differ from an IT audit?

In a production environment, safety and availability come first. That determines how an auditor works:

• No active scanning without approval — older PLCs and RTUs can crash on a network scan; NIST SP 800-82 explicitly warns against this. Active tests are only carried out with written approval from the person responsible for the process, during a maintenance shutdown or on a test environment.
• Passive measurement — the auditor prefers passive monitoring via a SPAN port or network tap, or exports from existing tools, to map assets and connections.
• Site walk-down — many findings are only visible on site: an open control cabinet, an unattended engineering laptop or a supplier’s 4G modem.
• Work permit and safety induction — auditors follow the site rules too, with personal protective equipment and an escort.
• Suppliers in scope — much OT maintenance is outsourced; IEC 62443-2-4 provides requirements against which you can audit a system integrator.
• Maturity rather than yes/no — OT assessments often measure the achieved Security Level or maturity level per zone, because full compliance in an existing plant is rarely achievable in a single step.

🇪🇺 What do NIS2 and the Dutch Cyberbeveiligingswet mean for audits?

The Cyberbeveiligingswet, the Dutch transposition of NIS2, entered into force on 15 August 2026 and applies to more than 8,000 organisations. Supervision is organised by sector; the Health and Youth Care Inspectorate, for example, supervises healthcare.

For essential entities, supervision is proactive: the authority may carry out inspections and impose regular or targeted security audits, performed by the authority itself or by an independent body. Targeted audits are based on a risk assessment and are paid for by the audited organisation. Important entities are mainly supervised after the fact, for example following an incident. Fines can reach 10 million euros or 2% of worldwide annual turnover for essential entities.

An existing ISO 27001 certificate or an IEC 62443 assessment is not a legal exemption, but it does supply much of the evidence a supervisory authority will ask for.

✅ What does an audit deliver?

A well-run audit is more than an obligation. It provides:

• Insight into risks, shortcomings and improvements — backed by evidence rather than assumptions
• Assurance of quality, safety and compliance — deviations are followed up systematically
• Confidence for customers, supervisory authorities and certification bodies — a certificate or assurance report makes your control demonstrable
• Lower risk of fines, product recalls or data breaches — because weaknesses come to light earlier

📋 How do you prepare for an audit?

1. Know the criteria — read the standard or legal requirements you will be assessed against, and define the scope.
2. Keep documentation current — policies, procedures, network diagrams and risk analyses must describe reality.
3. Check that processes are followed — track changes and notifications in a CMDB and version control.
4. Collect evidence in advance — log files, access overviews, backup restore test reports and pentest reports.
5. Practise with an internal audit or pre-assessment — so that you find the biggest gaps before an external party does.
6. Involve every discipline — IT, OT, QA, production, security and the suppliers who maintain your systems.

❓ Frequently asked questions

How often should an organisation carry out an audit?

For ISO 27001, an organisation carries out internal audits according to its own planned audit programme; the standard sets no fixed frequency, but most organisations audit annually and cover the full scope within the three-year certification cycle. In addition, the certification body performs an annual surveillance audit and a recertification audit every three years. Under NIS2, the supervisory authority can also impose additional audits on essential entities.

What is an audit trail?

An audit trail is a secure, automatically generated log that records who created, modified or deleted which data, and when. In the pharmaceutical industry, 21 CFR Part 11 requires such an audit trail to be time-stamped and not to obscure previously recorded values. An auditor uses audit trails as objective evidence that procedures have actually been followed.

May an auditor actively scan an OT network?

An auditor may only actively scan an OT network with explicit approval from the plant owner, because scans can disrupt older controllers. This is usually done during a maintenance shutdown or on a test system. For the rest of the audit, passive monitoring, configuration exports and a site walk-down are sufficient.

What is the difference between an audit and an assessment?

An audit checks against fixed criteria and produces a judgement on conformity, often with formal nonconformities. An assessment is broader and more advisory: it measures, for example, maturity or the achieved Security Level under IEC 62443 and identifies improvements. Many OT programmes start with an assessment and end with an audit.

What is the difference between ISAE 3402 and SOC 2?

ISAE 3402 is an international assurance standard that mainly covers controls relevant to customers’ financial reporting. SOC 2 is a US framework from the AICPA that assesses controls on security, availability, processing integrity, confidentiality and privacy. Both come as a Type I report (design at a single point in time) and a Type II report (operating effectiveness over a period, usually 6 to 12 months).

What happens after a major nonconformity?

After a major nonconformity, the organisation must analyse the root cause and take corrective action within an agreed period. The auditor then verifies whether the actions are effective, sometimes with an additional visit. In a certification audit, the certificate is only granted or renewed once the major nonconformity has been closed.

📌 In summary

An audit uses objective evidence to check whether processes and systems meet predefined criteria. It can be carried out internally, at a supplier, or by an independent certification body or supervisory authority. In OT environments an audit calls for extra caution, with passive methods and approval for every active test. With the Dutch Cyberbeveiligingswet, security audits are also becoming a legal instrument for many organisations.

An audit is a systematic, independent check against fixed criteria that gives you insight into risks and deviations, and with NIS2 and ISO 27001 it has become a standard part of IT/OT security.