Problem Statement
Discuss the difference between an internal audit, external audit and management review in a compliance programme.
Explanation
An internal audit is conducted by the organisation’s internal staff or internal audit department to evaluate compliance and effectiveness of controls. An external audit is performed by an independent certification body or regulator to verify compliance with standards or laws (e.g., ISO 27001 certification audit). A management review is a periodic senior management meeting to assess ISMS performance, allocate resources and approve improvements. Understanding these roles and how they feed into each other demonstrates interview readiness for compliance and risk roles.
