Cybersecurity Auditing

Glossary

Acceptance criteria

The specific, pre-agreed conditions a control, process, or piece of evidence must meet to be considered sufficient for the audit objective. Defining these upfront reduces scope creep and debate during fieldwork. Clear criteria also support consistent ratings across engagements.

Advocacy threat

A threat to auditor independence that arises when the auditor appears to promote or defend management’s position. This can bias judgments about control design or effectiveness. Auditors should avoid roles or actions that put them in the position of arguing for the auditee.

Alternative procedures

Substitute tests performed when preferred evidence is unavailable or incomplete. Examples include re-performance in place of missing logs or corroborating through third-party confirmations. Auditors must document why the alternative is appropriate and how it attains the same assurance.

Analytics-assisted testing

The use of data analysis to enhance coverage, precision, or efficiency of audit tests. Techniques range from simple filters and joins to statistical sampling and anomaly detection. Auditors should validate data lineage and quality to ensure conclusions remain reliable.

Anchoring bias

A cognitive bias where initial information (the “anchor”) unduly influences later judgments. In audits, early narratives or prior ratings can skew risk assessments and findings. Mitigate it by independently reviewing evidence and using structured decision checklists.

Audit ...