Question

Some experts encourage organizations to include internal and external parties in a security audit. This means it might include all end users, which would involve all staff and the customers or client base. There are risks for including both of those groups that are not associated with a standard IT Audit.

Provide your reasons for what group you might exclude from the security audit and what are your reasoning for excluding them? Are there regulatory or other reasons why they might not be able to be excluded?

Answer 1

Yes, it is always a good practice to include both internal and external audit teams to perform the audit for your company. If the external team is a well reputed auditing organisation, then it can be a wise decision to undergo an security audit with that external team. But there is something you need to exclude while undergoing an external audit as you don't want your data to be exposed to outsiders. Internal user group should be excluded from that security audit.

The internal user group having access to all the internal data of the organisation and this group should not undergo the external audit. Though there is a very very negligible chance of data breaching yet no chance should be taken as data always remains an integral part of the organisation.