ACW Soft Solutions

Security audits and control reviews

Review how selected security controls are implemented and evidenced. ACW examines the agreed application, configurations, and operating practices, then documents gaps and the work needed to address them.

Contact Us

Define what the review needs to establish

  • Unverified controls

    Policies describe a safeguard, but the team needs evidence of how it works in the system.

  • Unclear requirements

    Customer expectations, internal policies, and technical criteria have not been mapped to specific checks.

  • Unowned remediation

    Findings exist without affected assets, a correction plan, or a way to verify completion.

Review controls against explicit criteria

  • Control implementation

    Examine selected safeguards through suitable configuration checks, evidence review, and technical verification.

  • Readiness against requirements

    Map the named requirements to available evidence. Record gaps and exclusions without presenting the review as formal certification.

  • Configuration

    Review relevant settings and differences across the environments in scope. Investigate exceptions and outdated configurations.

  • Audit evidence

    Document what was inspected, when it was inspected, and the basis for each finding. Separate verified gaps from missing evidence.

What your team receives

  • A review scope and list of applicable criteria.

  • An evidence register identifying reviewed materials and limitations.

  • Findings linked to affected controls and systems.

  • Recommended corrective actions, priorities, and owners.

  • Follow-up or verification results where included.

From requirements to traceable findings

  1. Step 01.

    Agree the review

    Identify the application, environments, control set, stakeholders, and access available. Specify any source-code or runtime testing separately.

  2. Step 02.

    Collect evidence

    Review the required documents, configurations, and records. Establish permitted access and retention for the material collected.

  3. Step 03.

    Validate findings

    Confirm the issue and its context with the responsible team. Label areas that cannot be assessed with the available evidence.

  4. Step 04.

    Plan correction

    Turn findings into owned work. Define what evidence or technical check is needed to close each item.

Know what the report demonstrates

The report should make its criteria, coverage, evidence date, and limitations clear. A policy’s existence is different from a control operating as intended. Closing a finding requires the agreed verification, rather than simply changing its status in a tracker.

This is an example of a possible engagement, not an ACW client result.

Illustrative review: access removal

The review compares the access-removal procedure with selected account records and available system evidence. Differences become documented findings with owners and follow-up checks. Missing evidence remains an explicit limitation, not an automatic claim that access was correctly removed.

Questions before a review

Is this a certification audit?

No. This service describes a scoped technical and evidence review. Formal certification is not included or implied.

How is this different from penetration testing?

An audit reviews controls against defined criteria. Penetration testing investigates exploitable weaknesses through authorised technical testing; the two can have complementary scopes.

Can the review support a customer questionnaire?

It can provide evidence relevant to agreed questions. Answers should reflect the actual findings and limitations, not a blanket assurance.

Explore related services

Agree the question and evidence before the audit

Share the system, requirements, and existing materials you need reviewed.

Contact Us