IT & Cybersecurity Audit Advisory

Risk-based IT audits, ITGC and application control testing, and cybersecurity and cloud assessments, with findings owners can act on.

Our work is advisory. We don't perform financial statement audits or provide attest services.

Know which controls work before an auditor, an examiner, or an attacker finds out.

The challenge

Financial re­port­ing, cus­tomer trans­ac­tions, and daily op­er­a­tions all de­pend on sys­tems doing what man­age­ment be­lieves they do. Most con­trol fail­ures are quiet. An ac­cess re­view gets rub­ber-stamped. A change reach­es pro­duc­tion with­out ap­proval. A cloud set­ting drifts from its base­line. Often the first per­son to no­tice is an ex­ter­nal au­di­tor, an ex­am­in­er, or an at­tack­er, and by then the fix is ur­gent and ex­pen­sive.

How we help

We plan and carry out IT audit and cy­ber­se­cu­ri­ty work the way an ex­pe­ri­enced in­ter­nal audit team would. Before we test any­thing, we learn the busi­ness process, the sys­tems that carry it, and what a fail­ure would cost. That shapes the scope, so the hours go to real ex­po­sure rather than to what­ev­er is eas­i­est to test.

Our test­ing cov­ers every layer of con­trol: IT gen­er­al con­trols over ac­cess, change, op­er­a­tions, and re­cov­ery; ap­pli­ca­tion con­trols and the key re­ports peo­ple rely on; and the se­cu­ri­ty pro­gram around them, from iden­ti­ty and vul­ner­a­bil­i­ty man­age­ment to cloud con­fig­u­ra­tion and ran­somware re­cov­ery. We test de­sign and op­er­at­ing ef­fec­tive­ness against pri­ma­ry ev­i­dence.

Each find­ing states what failed, why it mat­ters to the busi­ness, and what will fix the root cause. We agree ac­tions with the peo­ple who own them, and we retest be­fore an issue is closed.

Standards we work with: COBIT 2019, the COSO Internal Control frame­work, ISACA's IT Audit Framework (ITAF), the IIA Global Internal Audit Standards, NIST CSF 2.0, CIS Controls v8, ISO/IEC 27001 and 27002, the CSA Cloud Controls Matrix, and NYDFS Part 500 where it ap­plies.

Our cy­ber­se­cu­ri­ty work is con­trol as­sess­ment, not pen­e­tra­tion test­ing. If you need a pen­e­tra­tion test, we can help you scope it and in­ter­pret the re­sults.

Good fit if your in­ter­nal audit team needs IT audit ca­pac­i­ty or spe­cial­ist depth, man­age­ment wants an ob­jec­tive read on IT con­trols be­fore year-end test­ing, or your board wants to know whether se­cu­ri­ty spend­ing is work­ing.

Related topics

  • IT audit
  • ITGC testing
  • SOX ITGC testing
  • IT application controls (ITAC)
  • Co-sourced IT internal audit
  • Cybersecurity assessment
  • NIST CSF 2.0 assessment
  • Cloud security assessment

Services in IT & Cybersecurity Audit Advisory

Select a service to see what it covers.

Risk-Based and Co-Sourced IT Audit

IT audit planned around your critical systems and obligations, delivered as a full outsourced function or as added capacity inside your own team.

We build the plan around what a failure would cost the business, not around what is easiest to test. As a co-sourcing partner, we work inside your methodology and tools, so our workpapers fit straight into your audit files.

What's included

  • A risk-based IT audit plan tied to critical systems and obligations
  • Co-sourced or outsourced delivery within your methodology
  • Workpapers built to stand up to review by your external auditors

Ask about this service

ITGC Testing

Design and operating effectiveness testing of IT general controls over logical access, change management, IT operations, and backup and recovery.

IT general controls protect every automated control and report that runs on a system. We test them against system-generated evidence across the full period, and we align the work with SOX expectations when your controls support financial reporting.

What's included

  • Logical and privileged access testing
  • Change management and segregation of duties
  • IT operations, job scheduling, and backup and recovery

Explore ITGC Testing Ask about this service

Application Control and Key Report Testing

Testing of the automated controls inside your applications, the interfaces between them, and the system reports (IPE) people use as evidence.

Automated controls only help if they are configured correctly, and the reports built on them are complete and accurate. We test calculations, edit checks, and interfaces, and we confirm that each key report used as evidence can be trusted.

What's included

  • Automated calculations, edit checks, and configurations
  • Interface completeness and accuracy
  • Key report (IPE) completeness and accuracy testing

Ask about this service

SOX IT Controls Support

Support for management and internal audit across SOX IT scoping, control design, walkthroughs, testing, and remediation.

We help management and internal audit get the IT side of SOX right, from deciding which systems are in scope to testing controls and fixing deficiencies. The work is organized so your external auditors can review it efficiently.

What's included

  • IT scoping and risk and control matrix design
  • Walkthroughs and control testing
  • Deficiency remediation support

Ask about this service

Cybersecurity Program Assessment

An assessment of your security program against NIST CSF 2.0, ISO/IEC 27001, or CIS Controls, with findings ranked by business impact.

We measure your security program against the framework you choose and rank every gap by its business impact. Leaders get a short summary of what is exposed and what to fund first, and your security team gets the detail behind it.

What's included

  • Control and maturity assessment against your chosen framework
  • Vulnerability, patch, and configuration management review
  • A prioritized roadmap with a summary for the CIO, CISO, and board

Ask about this service

Cloud Security Assessment

A review of identity, configuration, logging, and recovery controls in AWS and Azure, mapped to the shared responsibility model.

Your provider secures part of the stack and you secure the rest. We review your side of that line in AWS and Azure, covering identity, configuration, logging, encryption, and recovery.

What's included

  • Identity and access configuration in AWS and Azure
  • Secure configuration, logging, and monitoring
  • Backup and recovery for cloud workloads

Explore Cloud Security Assessment Ask about this service

Identity and Access Management Review

An enterprise-wide review of how identities are created, reviewed, and removed, with a focus on privileged accounts and joiner, mover, and leaver controls.

Many breaches involve an account with more access than it needed. We follow how accounts are created, changed, and removed, test how privileged access is controlled, and check whether access reviews actually catch problems.

What's included

  • Joiner, mover, and leaver process review
  • Privileged access management review
  • User access review quality and coverage

Ask about this service

Ransomware Readiness Assessment

A review of whether you could detect, contain, and recover from ransomware, starting with backups you have actually restored.

A backup you have never restored is a hope, not a control. We review backup isolation and restore results, test your response plan against a realistic scenario, and agree which systems come back first.

What's included

  • Backup isolation and restore testing review
  • Incident response plan and tabletop readiness
  • Recovery priorities for critical systems

Ask about this service

Explore our other practice areas

Governance, Risk & Compliance

Risk assessments, security policies, vendor oversight, and SOC 2 and ISO 27001 readiness, run as one connected program.

Learn more about Governance, Risk & Compliance

AI Governance

AI readiness, inventory, policy, and oversight, so every use of AI is visible, valuable, and accounted for.

Learn more about AI Governance

AI Risk, Security, and Audit

Risk assessments, security control reviews, and audits that show whether your AI holds up in daily use, and not only in policy.

Learn more about AI Risk, Security, and Audit

Data Privacy

Know what personal data you hold, where it goes, and whether your controls keep the promises in your privacy notice.

Learn more about Data Privacy

Forensic Accounting & Fraud Risk

Evidence-first analysis of financial irregularities, and of the control gaps that let them happen.

Learn more about Forensic Accounting & Fraud Risk

Professional Training

Workshops and cohorts that build audit, AI governance, and GRC skills inside your team.

Learn more about Professional Training

View All Services

Ways to work with us

Project engagements

A defined scope, timeline, and deliverable, such as an IT review, an AI governance build, or a remediation plan.

Advisory support

Ongoing access to senior guidance as your program, systems, and regulators change.

Audit capacity support

Added hands and specialist skill for your internal audit or risk team, working under your direction.

Training programs

Workshops and cohorts for your team, delivered on a schedule that suits you.

How we engage

  1. Discovery

    A short call to understand your situation.

  2. Scoping

    A written scope with deliverables, timing, and fees.

  3. Delivery

    Regular check-ins and findings you can read in one sitting.

  4. Follow-up

    A review of progress, plus support for what comes next.

Common questions

Are you a CPA firm?

No. We're a risk and tech­nol­o­gy ad­vi­so­ry firm. We don't per­form fi­nan­cial state­ment au­dits or issue audit opin­ions.

Can you help us prepare for SOC 2 or a similar report?

Yes, on the readi­ness side: gap as­sess­ment, con­trol de­sign, and ev­i­dence prepa­ra­tion. The re­port it­self must come from a li­censed CPA firm.

Do you work with our internal and external auditors?

Yes. We co­or­di­nate with in­ter­nal audit, your ex­ter­nal au­di­tors, and your com­pli­ance team so work isn't du­pli­cat­ed.

How long does an engagement take?

It de­pends on scope. After a scop­ing call, you'll get a time­line in writ­ing.

What size organizations do you work with?

Mid-mar­ket and en­ter­prise or­ga­ni­za­tions across in­dus­tries.

Will you keep our information confidential?

Yes. We'll sign an NDA be­fore you share sen­si­tive de­tails.

Can you assess an AI program you helped design?

No. We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client. If an en­gage­ment would cross that line, we'll tell you dur­ing scop­ing.

Is this legal advice?

No. We sup­port reg­u­la­to­ry align­ment from a risk and con­trols per­spec­tive. For legal ques­tions, work with coun­sel.

Not sure which service fits?

Describe the problem. We'll tell you where to start.

Talk to an Advisor