What is the difference between a risk assessment, an audit, and a penetration test?
For clarification under ISACA and IFPA standards: the Audit is a formal process performed by a qualified independent auditor. The audit generates a report viewed to represent a high assurance of truth. Audits are used in assessed reporting engagements. Assessments are less formal and frequently more cooperative with the people/objects under scrutiny. The assessment report is viewed to have lower value (moderate to low value) when compared to Audit. Assessments can include both outsider’s and internal self-assessments. The true value of the assessment is to create a sense of ownership by the user. Assessments are excellent vehicles for training and awareness. The goal of an assessment is to help the user/staff work towards improving their score. However the audit is the score that actually counts for regulatory compliance purposes. Remember the basic control requirement is to separate the “worker” from the person providing “authorization” (separation of duties). Assessments are consider
