Audit your own estate and track the findings to closure

applied · 80 min · Objective 5.5

Task

Run an internal audit against your lab, produce findings in the form an audit committee would receive, and then do the part organisations skip — track them to closure and check whether any recur.

Steps

  1. Define the audit scope and criteria explicitly in /tmp/audit-scope.md: which systems, against which standard, for which period, and what is excluded. An audit with no stated scope produces findings nobody can act on.
  2. Perform the audit by testing rather than by recollection, and record every finding in /tmp/findings.csv as id,finding,criteria,evidence,risk,owner,due_date,status.
  3. Write the evidence for each as something reproducible — the command and its output — so the finding can be re-verified by somebody else.
  4. Remediate three of them, and record the change.
  5. Re-run the audit. Confirm the three now pass, and that the re-run produces the same result for everything you did not touch — an audit that gives different answers on consecutive runs is measuring something other than the estate.
  6. Now deliberately reintroduce one of the three, re-run, and confirm it reappears as a REPEAT finding. Record in /tmp/audit-report.md why a repeat finding is a governance failure rather than a technical one.

Verify

python3 - <<'PY'
import csv,re
rows=list(csv.DictReader(open('/tmp/findings.csv')))
assert len(rows)>=6, 'fewer than six findings'
for r in rows:
    assert r['evidence'].strip(), 'no evidence for '+r['id']
    assert r['owner'].strip(), 'no owner for '+r['id']
    assert re.match(r'\d{4}-\d{2}-\d{2}', r['due_date'].strip()), 'no due date for '+r['id']
closed=[r for r in rows if r['status'].strip().lower() in ('closed','remediated')]
assert len(closed)>=3, 'fewer than three findings closed'
rep=[r for r in rows if 'repeat' in r['status'].strip().lower()]
assert rep, 'no repeat finding recorded - reintroduce one and re-run'
print('%d findings, %d closed, %d repeat' % (len(rows),len(closed),len(rep)))
PY
diff <(sort /tmp/audit-run1.txt) <(sort /tmp/audit-run3.txt) | grep -c '^[<>]'
grep -ciE "governance|recur|control did not" /tmp/audit-report.md

Every finding needs evidence, an owner and a due date, and at least three must close — an audit whose findings are never closed is a report. The repeat finding is the deliberate part: it is the single most damning thing an audit committee can see, because it means the remediation did not hold and nobody noticed.

Notes

The reproducibility check in step five matters more than it looks. An audit that returns different answers on consecutive runs against an unchanged estate is measuring the auditor's attention rather than the controls, and every finding it produces is arguable.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.