Some controls protect a single system. Others shape how the whole organization works. Entity-level controls are the second kind, and auditing entity-level controls means reviewing governance, risk management, policies, oversight and culture. When they are weak, problems appear everywhere. When they are strong, individual control failures get caught and fixed.
This guide explains what entity-level controls are, why auditing entity-level controls usually comes first in an IT audit, and how to do it with a practical checklist.
What are entity-level controls?
Entity-level controls apply across the organization, rather than to one application or server. In IT, they typically include:
- IT governance: strategy, steering committees and reporting to the board;
- risk management: how the organization identifies and treats IT risks;
- policies and standards, and how staff learn about them;
- organization and roles, including segregation of duties;
- oversight of third parties and outsourcing;
- monitoring, such as internal audit and management reviews.
Frameworks like COSO (for internal control) and COBIT (for IT governance) describe these controls in detail.
Why audit them first?
Entity-level controls set the context for everything else. For example, if there is no risk assessment, nobody can explain why certain systems get more protection. If policies are missing, there is nothing to test system settings against. As a result, auditors often review entity-level controls early, and then adjust the depth of detailed testing.
Five steps to audit entity-level controls
1. Understand the control environment
First, read organization charts, committee charters, policies and recent board or management reports. Then interview senior IT and business leaders. The goal is to understand how decisions are really made.
2. Evaluate the design
Next, ask whether the controls, as designed, would address the main risks. For example, does the risk process cover cyber threats, cloud services and suppliers? Do policies cover all key areas?
3. Test operating effectiveness
Then check that the controls actually run. For instance, sample steering committee minutes, risk register updates, policy reviews and training records over the past year.
4. Document evidence
Record what you reviewed, who you spoke to and what you concluded. Clear workpapers let others rely on your work.
5. Report to management
Finally, present findings with their business impact and agreed actions. Entity-level findings often need senior sponsorship, so frame them in business language.
Checklist for entity-level controls
Governance and strategy
- An IT strategy exists and links to business goals.
- An IT or security steering committee meets regularly and records decisions.
- The board or a committee receives regular reports on cyber risk.
- Budget and resources match the agreed priorities.
Risk management
- A documented process identifies, assesses and treats IT and security risks.
- Risk owners accept residual risks formally.
- The team updates the risk register at least once a year and after major changes.
Policies and people
- Management approves security policies and reviews them regularly.
- Staff receive training on policies, and records show completion.
- HR processes cover screening, joiners, movers and leavers.
Organization and roles
- Roles and responsibilities for IT and security are documented.
- Segregation of duties prevents one person from controlling a whole critical process.
Third parties
- A process assesses and monitors key IT suppliers and cloud providers.
- Contracts include security and audit clauses.
Operations and change
- Change management controls system configurations to avoid unplanned outages.
- Incident management and business continuity processes exist and are tested.
Monitoring
- Internal audit or an independent function reviews IT controls.
- Management tracks audit findings until closure.
- Key metrics, such as patch levels and incident counts, reach management regularly.
Related guides
Sources
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
