A Guide to Conducting an Internal Compliance Audit

Effective audit planning starts with scope definition, which is itself a risk-based exercise. You cannot audit everything every year — and you should not try. Define the audit universe: the complete set of compliance domains, processes, controls, and organisational units that could be subject to internal audit. Then apply risk-based prioritisation to determine which elements of the audit universe are included in the current audit cycle. Factors driving prioritisation include: regulatory materiality (obligations with the highest penalty exposure or supervisory attention), control criticality (controls protecting the most sensitive assets or highest-impact processes), time since last audit (areas not audited recently carry inherent assurance decay), and change impact (areas affected by significant organisational, technological, or regulatory changes since the last audit).

Develop a multi-year audit plan that ensures complete coverage of the audit universe over a defined cycle — typically three years. Within each year, prioritise the highest-risk domains while ensuring every domain receives attention within the cycle. The annual audit plan should be approved by the management body or audit committee to provide governance oversight and ensure alignment between audit priorities and organisational risk appetite. For the first internal audit cycle following NIS2 or DORA entry into force, prioritise the areas supervisory authorities have signalled as Year 1 examination targets: management body governance, incident reporting capability, supply chain security, and the completeness of risk-management measures.

For each audit engagement, produce a formal audit plan documenting the audit objectives, scope boundaries (what is included and explicitly what is excluded), audit criteria (the specific regulatory requirements, standards, or policies against which compliance will be assessed), methodology (interviews, document review, testing, data analytics), timeline, resource requirements, and the responsible audit team. Distribute the audit plan to the audited area's management in advance — internal audit should not be an ambush. Giving stakeholders advance notice allows them to prepare evidence and allocate time for interviews, which improves audit efficiency and the quality of findings.

Internal compliance audit methodology combines several evidence-gathering techniques: document review, interviews, observation, re-performance, and data analytics. Document review assesses the existence and adequacy of policies, procedures, and records — does the entity have an incident response plan, does it cover Article 23/Article 19 requirements, and was it reviewed within the required cycle? Interviews with control owners and operational staff assess understanding and implementation — do personnel know their responsibilities, can they describe the process they follow, and does their description match the documented procedure? Observation and re-performance test operational effectiveness — watch an access review being conducted, or independently repeat a control activity to verify it produces the expected result.

Data analytics has become an increasingly powerful audit technique for EU compliance. Rather than sampling a handful of access rights for manual review, query the identity platform's logs to assess all privilege changes over the audit period. Rather than reviewing a sample of incident records for reporting compliance, analyse the complete incident dataset against the 24-hour/72-hour/1-month timeline requirements. Rather than asking whether vulnerability scans run weekly, query the scanner's execution logs to verify frequency and coverage. Data analytics transforms audit from a sample-based exercise into a population-based assessment, dramatically improving the reliability of audit conclusions and reducing the risk that significant exceptions escape detection through sampling limitations.

Document audit evidence meticulously. For each audit finding — both positive (control operating effectively) and negative (control gap or deficiency) — record the specific evidence that supports the conclusion: the document reviewed, the interview conducted, the data analysed, the test performed, and the result observed. Evidence documentation serves two purposes: it supports the credibility of audit findings during management review and remediation discussions, and it creates an audit trail that demonstrates the rigour of the internal audit function to supervisory authorities. If a competent authority questions a compliance assertion, the internal audit evidence should be available to substantiate it.

Internal audits and external audits serve complementary purposes. Internal audits provide management assurance and drive improvement; external audits provide independent assurance to third parties. For ISO 27001, the external certification audit (conducted by an accredited certification body) assesses ISMS conformity with the standard. For DORA, the competent authority may conduct or commission examinations and inspections under Article 50. For NIS2, competent authorities conduct audits and inspections under Articles 32-33 for essential and important entities respectively. A mature internal audit programme improves external audit outcomes by identifying and remediating issues before external auditors discover them.

Coordinate internal and external audit activities to maximise coverage and minimise disruption. Share the internal audit plan with external auditors (where appropriate) so they can rely on internal audit work where it meets their standards for scope and quality, reducing the extent of their own testing. ISO 27001 certification auditors routinely review internal audit results and may place reliance on internal audit findings, provided the internal audit function demonstrates competence, independence, and methodological rigour. NIS2 and DORA supervisory authorities similarly assess the entity's internal assurance capability as part of their examination — a well-functioning internal audit programme signals mature compliance management.

Prepare for supervisory examinations by maintaining a standing evidence package that can be produced on demand. This package should include: the compliance programme charter, the current internal audit plan, completed internal audit reports from the current and prior cycle, the findings and remediation tracker with current status, policy documents with version history, control testing results, incident records and reporting evidence, training completion records, and management body meeting minutes demonstrating oversight. Organise the evidence package by regulatory requirement (Article 21 categories for NIS2, the five pillars for DORA, ISMS clauses for ISO 27001) so that supervisory staff can navigate it without requiring explanation. The faster you can produce comprehensive, well-organised evidence, the smoother the supervisory examination will proceed.