GRCOPILOT Insights

Insights, guidance and product updates on cybersecurity, GRC and compliance.

The Essential Eight assessment: what an assessor actually checks
Audit

The Essential Eight assessment: what an assessor actually checks

Assessors test rather than take your word for it. How the assessment works, the evidence that satisfies each strategy, the sampling that catches partial coverage, and how to prepare without inflating your rating.
Firewall rule review: finding the any-any rule from 2019
Audit

Firewall rule review: finding the any-any rule from 2019

Rule bases grow, never shrink, and eventually nobody knows what half of them are for. What a review should look for, how to remove rules safely, and why this is an audit finding waiting to happen.
Purple teaming: testing whether your detections actually fire
Audit

Purple teaming: testing whether your detections actually fire

A red team tells you that you were beaten. A purple team tells you exactly which detection failed and why. The cheaper, more repeatable exercise most organisations should be running instead.
SOX IT general controls: what external auditors actually test
Audit

SOX IT general controls: what external auditors actually test

ITGCs underpin every automated control an auditor relies on, which is why a weakness in access or change management can cascade into a material weakness. The three domains, what evidence is expected, and where testing usually fails.
Audit and assurance: the complete guide
Audit

Audit and assurance: the complete guide

What auditors test and how, what evidence actually counts, how findings are graded, and how to run the internal audit and management review cycle that certification depends on.
The compliance evidence matrix: what each framework actually asks you to produce
Audit

The compliance evidence matrix: what each framework actually asks you to produce

Auditors do not ask for controls, they ask for artefacts. A control-domain-by-framework matrix of the evidence ISO 27001, SOC 2, the NCA ECC and PCI DSS expect - and the ones organisations never have ready.
SOC 2 carve-out vs inclusive: the part of the report customers misread
Audit

SOC 2 carve-out vs inclusive: the part of the report customers misread

Your cloud provider's controls are either carved out of your report or included in it. The choice changes what your report actually proves - and most readers never notice which one they are holding.
SOC 2 bridge letters: what they cover, and what they cannot
Audit

SOC 2 bridge letters: what they cover, and what they cannot

Your report period ended in March and a customer is asking in September. A bridge letter covers the gap - but it is management's assertion, not an audit, and treating it as equivalent causes problems on both sides.
Major, minor, observation: what each audit finding actually costs you
Audit

Major, minor, observation: what each audit finding actually costs you

The grade determines whether you have a certificate, a deadline, or a suggestion. What separates the categories, how to respond to each, and the argument that legitimately gets a finding downgraded.
Stage 1, Stage 2 and surveillance: the three-year certification cycle explained
Audit

Stage 1, Stage 2 and surveillance: the three-year certification cycle explained

Certification is not one audit, it is a cycle - and the years after the certificate is issued are where programmes quietly decay. What happens at each stage, and what each one is really testing.
How auditors actually test controls: inquiry, observation, inspection, reperformance
Audit

How auditors actually test controls: inquiry, observation, inspection, reperformance

Four testing methods of very different strength, plus sampling and the population question that decides whether your sample means anything. Knowing the method tells you exactly what to prepare.
Design vs operating effectiveness: the distinction that decides your audit
Audit

Design vs operating effectiveness: the distinction that decides your audit

A control can be perfectly designed and still fail an audit, or operate flawlessly and still be judged inadequate. Two separate tests, two separate failure modes, and two very different fixes.
Running an internal audit programme that is worth doing
Audit

Running an internal audit programme that is worth doing

Internal audit is mandatory for ISO 27001 and valuable everywhere else - but only if it is independent and finds things. How to plan, staff, conduct and evidence it, including when you are small.
Correction vs corrective action: closing findings so they stay closed
Audit

Correction vs corrective action: closing findings so they stay closed

Fixing the instance an auditor found is a correction. Fixing why it happened is corrective action. Confusing the two is why the same finding returns every cycle - and why auditors check.
The management review: the meeting that certifies your ISMS
Audit

The management review: the meeting that certifies your ISMS

A mandatory ISO 27001 clause that most organisations treat as a formality - and then fail on. What inputs are required, what outputs must be recorded, and how to run one that is genuinely useful.
Working with your external auditor without losing weeks
Audit

Working with your external auditor without losing weeks

Fieldwork drags when evidence requests bounce around email. How to run the auditor relationship - the PBC list, a single request queue, scoped access and clean handling of findings.
User access reviews: the control auditors fail you on most
Audit

User access reviews: the control auditors fail you on most

Access reviews are the most-sampled and most-failed control in security audits. How to run one that holds up - scope, cadence, reviewer selection, evidence, and closing the loop on revocations.
Common audit mistakes - and how to avoid them
Audit

Common audit mistakes - and how to avoid them

The mistakes that turn a manageable audit into a painful one: last-minute evidence, over-broad scope, policies nobody follows, unprepared interviewees and mishandled findings - with the fix for each.
What evidence auditors expect (and what they reject)
Audit

What evidence auditors expect (and what they reject)

The evidence auditors actually accept for the most-tested controls, the four properties every artefact needs, and the common submissions that get rejected - with the stronger alternative for each.
Audit preparation guide: a 90-day plan
Audit

Audit preparation guide: a 90-day plan

A structured 90-day audit preparation plan - what to fix first, how to organise evidence, how to run the fieldwork week, and how to handle findings without losing control of the outcome.
© 2026 GRCOPILOT