A risk assessment prioritises what might happen and what to treat, while a security audit verifies what is in place and whether it meets agreed criteria. The first produces a risk register and treatment plan. The second produces an evidence-based audit report.
TL;DR:
- Start with business impact and credible scenarios, then rank likelihood and consequences; a technology inventory alone can misdirect limited security budgets.
- For a regulation, contract, certification effort, or customer request, use an audit to produce independent, verifiable evidence against criteria agreed before testing.
- When a major change lands near a compliance deadline, assess first, convert high priority treatments into testable controls, then audit those controls.
- An audit can confirm controls meet agreed criteria, but it cannot show whether those criteria cover your actual exposure; assess that separately.
- Assess after major changes, schedule audits annually or according to risk, and review risks continuously only when your team has capacity.
Table of Contents
- How does a risk assessment work, step by step?
- How does a security audit work, and what types are there?
- Where do the two differ in practice?
- How do you combine assessments and audits in one assurance programme?
- When should you choose an assessment, an audit, or both?
- How do we approach assessments and audits?
- Why sequencing matters more than the label
- How can we help with your assessment or audit?
- FAQ
- Sources
How does a risk assessment work, step by step?
A risk assessment looks forward. It identifies the threats, vulnerabilities and business impact that matter most, so limited budget goes to the controls that reduce real risk. The NCSC basic risk assessment method is a sensible starting point, and it is meant to be tailored to your organisation rather than applied as a fixed template.
- Define the scope of the assessment.
- Identify assets and the business impact if they are lost or disrupted.
- Assess threats and vulnerabilities.
- Estimate the likelihood of each credible scenario.
- Assess the resulting cyber risk and prioritise it.
- Propose treatments and write the treatment plan.
- Produce the risk register, then create an assurance plan and iterate.
The outputs are a risk register, a prioritised roadmap, recommended treatments and a list of items that need assurance later.
Pro Tip: Start from business impact and credible scenarios, not from a technology inventory. A risk ranked without reference to what the business needs to protect is only a guess.
How does a security audit work, and what types are there?
An audit checks controls against criteria agreed in advance: a policy, a standard, a contract or a law. ISO 19011:2026 defines an audit as a systematic, independent and documented process that obtains objective evidence and evaluates it against those criteria. The practical workflow follows from that:
- Set the scope and the audit criteria.
- Plan the work and the sampling.
- Collect and verify objective evidence such as records, configurations and factual statements.
- Evaluate the findings against the criteria.
- Report the results.
- Follow up to confirm remediation.
Audit arrangements can vary: they may be conducted internally, by a supplier or customer, or by an independent third party. Whichever you choose, independence matters.
Audit evidence must be relevant and verifiable. Independence, integrity, fair presentation and due professional care are what make an audit credible, according to ISO guidance.
Where do the two differ in practice?
The simplest model is prioritisation versus verification. Both can sit inside one programme, but they answer different questions.
- Goal: an assessment prioritises risk and treatment. An audit verifies controls against criteria.
- Time horizon: an assessment is prospective and scenario-led. An audit evaluates evidence against criteria.
- Main deliverable: a risk register and treatment plan, against an audit report with evidenced findings.
- Consumers: the assessment informs leadership and budget holders. The audit serves compliance owners, customers, regulators and certification bodies.
- Frequency: assessments follow change and risk. Audits follow a planned programme.
An audit cannot replace a business risk assessment, because it tests controls against criteria without asking whether those criteria cover your real exposure. An assessment, in turn, does not give the independent evidence an audit provides. The NCSC Cyber Assessment Framework 4.0 sits in between: it is outcome-focused and supports both self-assessment and independent assessment.
How do you combine assessments and audits in one assurance programme?
Run the risk assessment first, then let it decide what the audits examine. This keeps audit effort on the controls that protect the highest-priority risks instead of spreading it evenly across everything.
- Complete the assessment and rank the risks.
- Take each risk treatment item and write the control it relies on in testable terms.
- Turn those statements into audit criteria, for example “privileged access to the core switches requires multifactor authentication and is reviewed on a regular basis”.
- Scope the audit to the highest-priority controls and agree what evidence will count.
- Feed audit findings back into the register, then reassess after major changes.
The NCSC method ends with an assurance plan and continual iteration for this reason: the assessment says what to trust least, and the audit shows whether your treatments hold. Treat it as a loop, not a one-off project. If you are building the compliance side, our cybersecurity compliance basics guide is a useful primer.
When should you choose an assessment, an audit, or both?
Pick the activity from the trigger, not from habit or whichever name your last supplier used.
- Choose an assessment for a new system, a major change, unclear business impact, or when you must prioritise a limited budget.
- Choose an audit when a regulation or contract demands it, when you are pursuing certification, or when a customer or supplier needs independent evidence.
- Choose both when a significant change lands close to a compliance deadline: assess first, audit second.
A workable cadence is event-driven assessments, annual or risk-based audits, and continuous risk review where you have the capacity.
Pro Tip: If a team is preparing for a certification-style audit, run a pre-audit check first. Our Cyber Essentials Plus pre-audit checklist shows what evidence to gather in advance.
How do we approach assessments and audits?
We start from business impact, scope the work pragmatically, and pair risk-led priorities with evidence-driven audits. Where it helps, we continue with managed assurance so findings do not sit in a report. We work as a Cisco partner, and we publish practical resources such as our network audit checklist for teams that want to prepare themselves.
A risk assessment can help an organisation identify which controls to examine more closely. An audit can then test those controls against agreed criteria, and findings can inform ongoing assurance.
Why sequencing matters more than the label
Most teams I meet treat “audit” and “assessment” as interchangeable, then wonder why the report does not answer their question. The label matters less than the order. An audit run without a prior risk assessment verifies the wrong things very thoroughly. A risk assessment with no audit afterwards leaves you with confident opinions and no proof.
The conventional advice also overrates the checklist. Checklists are useful for audit criteria, but buying controls because they appear on one is how budgets get spent without risk falling. Rank the risks, write the treatments as testable statements, and let those become your audit scope.
What to do first: pick your three highest business-impact scenarios and ask whether you could show an outsider evidence that the controls protecting them work. If you could not, you need an audit. If you cannot name the scenarios, you need an assessment.
— Jacob
How can we help with your assessment or audit?
We map your need to the right piece of work, and our consultants take it from scoping through to follow-up.
- Risk assessments and treatment planning: through our Professional Services.
- Audits against agreed criteria: through our Network Audits.
- Ongoing assurance after the findings: through our Managed Services and Network as a Service.
The next step is a scoping call or discovery workshop. You receive a scoped checklist or proposal that states what we would assess or audit and what evidence we would expect. Current pricing details are on our website. Contact us to book a call.
FAQ
Are an audit and an assessment the same thing?
No. A risk assessment identifies and prioritises what could harm the organisation, while an audit checks whether controls meet predefined criteria and produces evidence. They work best in sequence, with the assessment shaping the audit scope.
What is an IT security audit?
An IT security audit is a systematic, independent and documented check of your controls against criteria such as a policy, standard, contract or law. ISO 19011:2026 frames it around objective, verifiable evidence rather than opinion.
Should we run the risk assessment or the audit first?
Run the risk assessment first. It ranks your risks and gives the audit a sensible scope, so effort goes to the controls that protect the highest-priority scenarios.
Can a risk assessment satisfy a compliance audit requirement?
Generally not on its own. An assessment shows how risk was judged, but an audit requires independent, verifiable evidence against set criteria. Check the exact wording of your contract or regulation.
Sources
Recommended
- Firewall Audit Checklist for IT Security
- Network audit checklist for IT managers
- Network assurance for IT teams: a practical guide
- Cybersecurity compliance basics: 2026 guide for IT teams
