{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-no-independent-audit","description":"Because independent internal and external audit and review of information security are not performed, control deficiencies and non-conformities are neither detected nor challenged, so weaknesses persist unremediated and management and the board lose reliable assurance over control effectiveness.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"compliance-no-independent-audit","taxonomies":["iso-27005-vulnerability","coso-erm-risk"],"treatment":"mitigate"},"id":"risk:compliance-no-independent-audit","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-no-independent-audit","sourceIds":["ccpa","cobit-2019","iia-2024","iia-pos-2026-erm","iia-pos-2026-three-lines","iso-27001","nis2","nist-800-53"],"sourceUrl":null,"title":"Lack of independent audit and compliance review","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:00fd57914a237471975b58eb0d86ffd39f9bab0f4ec47e25cfec1a6faadb3251","properties":{"rationale":"Documented engagement methodologies and approved work programs are how conformant independent audit is planned and performed.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-11-80294fe7.json","sourceId":"uc:UC-AUDIT-11","targetDetailPath":"/data/v1/records/risk-compliance-no-independent-audit-9e1acf0f.json","targetId":"risk:compliance-no-independent-audit","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:042938fc63982c68a49f5a52a113bf75ba5a5107485398d9cc0d6b00da702a87","properties":{"rationale":"Collective competency and continuing professional development are required for the function to deliver credible independent assurance.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-06-3a5916e0.json","sourceId":"uc:UC-AUDIT-06","targetDetailPath":"/data/v1/records/risk-compliance-no-independent-audit-9e1acf0f.json","targetId":"risk:compliance-no-independent-audit","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:083eb07ca149e8112ed6cf7541a60e05026915716647852270d94d91d25914e5","properties":{"rationale":"Planning and obtaining independent reviews of information security at intervals and after change (ISO A.5.35) is the independent-review control this risk lacks.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-23-124d94d5.json","sourceId":"uc:UC-AUDIT-23","targetDetailPath":"/data/v1/records/risk-compliance-no-independent-audit-9e1acf0f.json","targetId":"risk:compliance-no-independent-audit","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:195c77e86c3a1a11349e89ef584cde371806f0613b27ef3e8e42545dc859c910","properties":{"rationale":"A board-approved mandate/charter granting unrestricted access to records and personnel establishes the authority for independent audit to operate.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-02-0279f203.json","sourceId":"uc:UC-AUDIT-02","targetDetailPath":"/data/v1/records/risk-compliance-no-independent-audit-9e1acf0f.json","targetId":"risk:compliance-no-independent-audit","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:679df51ba19baa1ab408a42c81b70fee5d365a672037b38e8826035adc254a84","properties":{"rationale":"An independent internal audit function reporting functionally to the board is exactly the independent-assurance capability whose absence defines this risk.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-01-10668058.json","sourceId":"uc:UC-AUDIT-01","targetDetailPath":"/data/v1/records/risk-compliance-no-independent-audit-9e1acf0f.json","targetId":"risk:compliance-no-independent-audit","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6dc517387a11bccda97a12f25e46863a4621a1e7f9f84ab22a10ed80249b823e","properties":{"rationale":"Engagement-level risk assessment, objectives, scope, and criteria are core planning steps of a conformant independent audit.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-12-657c1271.json","sourceId":"uc:UC-AUDIT-12","targetDetailPath":"/data/v1/records/risk-compliance-no-independent-audit-9e1acf0f.json","targetId":"risk:compliance-no-independent-audit","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7570c0c37de5d53d21740767fc8ea868bdbe27a8ca8b45beddf0b5ced8d127c2","properties":{"rationale":"Individual objectivity with conflict screening, rotation, and recusal is what makes the audit genuinely independent and its assurance reliable.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-05-3332a81f.json","sourceId":"uc:UC-AUDIT-05","targetDetailPath":"/data/v1/records/risk-compliance-no-independent-audit-9e1acf0f.json","targetId":"risk:compliance-no-independent-audit","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8826af7bcd4bdfeaf33eca5b5812a47ee268736e8e2a5e06cf93ef4480ed9ffc","properties":{"rationale":"Regularly assessing control effectiveness and tracking findings to closure detects and challenges deficiencies that would otherwise persist.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-22-c0b503b4.json","sourceId":"uc:UC-GOV-22","targetDetailPath":"/data/v1/records/risk-compliance-no-independent-audit-9e1acf0f.json","targetId":"risk:compliance-no-independent-audit","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9d5e6c7e84fade1840d96405a8aeab4f52af00e44bc62d3873e9fb1ed4685ec0","properties":{"rationale":"Sufficient workpaper documentation and engagement supervision/review ensure the quality and conformance that make an audit truly independent.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-15-18fe3d07.json","sourceId":"uc:UC-AUDIT-15","targetDetailPath":"/data/v1/records/risk-compliance-no-independent-audit-9e1acf0f.json","targetId":"risk:compliance-no-independent-audit","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a4090f3b6543ff6b4b404bce0d2a6425c0ee587463037230f8ad54e3dd6bec75","properties":{"rationale":"A periodic external quality assessment by an independent assessor is itself an independent review validating audit conformance.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-20-6032484b.json","sourceId":"uc:UC-AUDIT-20","targetDetailPath":"/data/v1/records/risk-compliance-no-independent-audit-9e1acf0f.json","targetId":"risk:compliance-no-independent-audit","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:affd917cc89589663894574ff457aaa83cbc34be4d0f5457fbce820f92b04277","properties":{"rationale":"Confidentiality (IIA Principle 5) is a required element of the IIA-conformant internal-audit function this risk lacks.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-08-b0e8d44c.json","sourceId":"uc:UC-AUDIT-08","targetDetailPath":"/data/v1/records/risk-compliance-no-independent-audit-9e1acf0f.json","targetId":"risk:compliance-no-independent-audit","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f179950d0a4965a393fcf2173db2ed4fdf20e35ba2bb4f5842bffededb3f232c","properties":{"rationale":"Evaluating findings into conclusions and root-cause recommendations/action plans is core independent-audit output.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-14-5c0dbe8f.json","sourceId":"uc:UC-AUDIT-14","targetDetailPath":"/data/v1/records/risk-compliance-no-independent-audit-9e1acf0f.json","targetId":"risk:compliance-no-independent-audit","type":"mitigates"}],"schemaVersion":1}