Can you act as our internal audit function?

We can provide independent IT audit capability alongside your existing arrangements. Where we designed or implemented a control, we say so and avoid auditing our own work.

How is this different from a security assessment?

Audit tests whether stated controls operate as described, with evidence for a period. Security assessment tests whether the environment can be attacked. Both are useful; they answer different questions.

How does a internal it audits engagement start?

With a short discovery conversation and a written view of scope, risk and the decisions to be made. That view is useful to you whether or not the work continues.

How is a internal it audits engagement priced?

Scope and, where relevant, rules of engagement are agreed in writing before any work begins, and the engagement is a fixed fee for that scope or phased with a cost envelope per phase — so you know the cost and the boundaries up front. Larger pieces of work are broken into phases with findings delivered early rather than a single invoice at the end.

Governance, Risk & Compliance · Govern

Internal IT Audits

Management is often told that controls are working, but assertion and evidence are different things, and the gap only shows at external audit. We run internal IT audits that plan coverage on risk, test both the design and the operation of controls against real evidence, and report findings with their impact and root cause. Each finding comes with an agreed management action, and we verify afterwards that the action was completed and effective rather than merely closed. Where we designed or implemented a control ourselves, we say so and avoid auditing our own work.

In short

Internal IT audits independently test whether technology controls are designed well and operating as described. They replace the assertion that controls work with evidence of whether they actually did over the period examined.

Start a conversation

What we do

The work inside internal it audits.

Audit planning

We plan coverage on risk, obligation and time since the last review, rather than auditing the same comfortable areas each year. Planning on risk means scarce audit time lands where a failure would matter most. It also makes the cycle defensible, since coverage can be shown to follow a rationale rather than habit.

Design and effectiveness testing

We test both whether a control is designed adequately and whether it operated consistently across the period. A control can be well designed yet skipped in practice, or diligently performed yet incapable of achieving its purpose; both are findings. Testing over a period, with sampled evidence, is what distinguishes real assurance from a point-in-time inspection.

Findings and management response

We report findings with their impact, root cause and an agreed management action and owner. Naming the root cause stops the same issue recurring under a different symptom next year. Agreeing the action with management at the time means the report leaves with commitments rather than a list of complaints.

Follow-up verification

We verify that agreed actions were actually completed and effective, not merely marked closed. Recurring external findings almost always trace back to actions that were reported done but never tested. Independent follow-up is what breaks that cycle and gives management confidence the issue is genuinely resolved.

What you receive

Deliverables, in writing.

Documented output your teams keep and can act on without us in the room.

Risk-based audit plan
Test results with evidence per control
Findings report with agreed management actions
Follow-up verification report

When this work helps

You may be facing this.

IT controls have never been independently tested
External audit findings recur year after year
Management asserts controls work with no evidence

How an engagement runs

Discover, assess, design, deliver.

01
Discover
Establish the obligations, decision rights, and risks that genuinely matter to this organisation. We separate the requirements that truly apply from those assumed to, so effort is not spent governing risks you do not carry.
02
Assess
Review existing controls, policy, evidence, and how the work is actually performed. We compare the control on paper with the control in practice, because the gap between the two is usually where the real risk sits.
03
Design
Design a proportionate control set with named ownership, evidence, and review cadence. Every control has an owner who can operate it and a defined source of evidence, so nothing depends on memory or heroics.
04
Deliver
Embed the changes with the teams doing the work, and test that the controls operate. We hand over controls the process owners can run themselves, rather than a framework only we understand.

Where we work

Delhi, India — and wherever the work is.

Fidova provides governance, risk and compliance consulting from Delhi, India, and works with organisations operating in several jurisdictions at once, mapping obligations across regions to one coherent control set.

Engagements run in English, are scheduled around your time zone, and can be delivered remotely end to end, with on-site time planned where a phase genuinely benefits from being in the room.

Related services

Often needed alongside this.

Compliance Gap Assessments

A compliance gap assessment measures your current position against a framework or obligation and states what is missing. It is deliberately short, because its job is to inform a decision about scope, budget and timing, not to become the programme itself.

Control Testing & Assurance

Control testing and assurance verifies with evidence that controls operated as intended over a period. Done on a cycle, it turns the annual scramble for evidence into a by-product of controls simply running.

Data Privacy & Protection

Data privacy and protection work establishes lawful, minimised and secure handling of personal data across its lifecycle. It maps the obligations of the regimes that apply to you — including India's DPDP Act and GDPR where relevant — onto one control set rather than running separate programmes.

All governance, risk & compliance services

Questions