A controls audit, particularly SOC2 (Service Organization Control 2), evaluates the design and effectiveness of an organization's internal controls related to security, availability, processing integrity, confidentiality, and privacy. SOC2 audits are performed by independent auditors to assess whether the organization's controls meet the defined criteria. Type 1 audits assess the design of controls, while Type 2 audits verify the operational effectiveness of controls over a specific period. We help you design and test your controls and close gaps before the independent auditor arrives.

A compliance audit tests whether your controls meet the requirements of a specific law, regulation or contract, such as HIPAA, PHIPA or PIPEDA, or a customer’s security schedule. A COBIT audit uses the ISACA COBIT framework to assess how well IT governance and management processes support the organization’s objectives, and where the gaps are.

An information security program and governance review evaluates the overall effectiveness and maturity of an organization's information security practices and governance structure. This review assesses the organization's policies, procedures, controls, and management practices to ensure they align with industry best practices and regulatory requirements. It helps identify gaps and opportunities for improvement in the organization's security program and governance framework.