Audits and Assessments
Audits & Assessments
Review data protection, information security and compliance systematically, with transparent findings and prioritised next steps.
Audit types
The right audit for your objective
The subject of the audit determines the criteria, stakeholders and evidence required. Robin Data defines the scope in advance and aligns the review with your starting point and agreed reference framework.
Data Protection Audit
Reviews the organisation, processes and documentation against agreed data protection criteria. Risks, gaps and improvement needs are translated into a prioritised action plan.
ISMS and ISO 27001 Audit
Assesses the maturity of the information security management system against the agreed framework, such as ISO/IEC 27001 or BSI IT-Grundschutz, and makes gaps transparent.
Compliance Audit
Examines a defined compliance management system or selected compliance processes against the agreed standard and creates a reliable basis for improvement.
Approach
An audit in five transparent steps
The exact process is adapted to the scope and assessment criteria. These five steps provide the shared framework.
1. Define objective and scope
Agree the question, subject, reference framework, organisational units and expected deliverables.
2. Prepare information
Compile existing policies, evidence, process descriptions and other relevant information systematically.
3. Assess the current state
Review documents, processes and working practices against the agreed criteria and involve relevant stakeholders.
4. Evaluate findings
Assess and prioritise gaps, risks, strengths and opportunities for improvement transparently.
5. Derive measures
Summarise findings in an accessible report and prepare concrete next steps with clear responsibilities.
An internal audit or assessment is not a certification. An independent certification decision can only be made by the appointed certification body.
What an audit helps you achieve
An audit provides a reliable assessment of the current state. It shows which requirements have already been implemented, where gaps or risks exist and which next steps are likely to have the greatest impact. An agreed assessment framework is essential so that findings are transparent and can be reviewed again later.
Robin Data combines document review, interviews and the examination of selected processes. Findings are presented clearly and prioritised by urgency and impact. The documents, sites, processes and people included depend on the agreed scope.
Data Protection Audit
A data protection audit examines data protection governance and implementation against agreed criteria. The scope may include responsibilities, processing activities, legal bases, transparency information, data subject rights, erasure concepts, technical and organisational measures and existing evidence.
The audit can provide a starting point for a data protection management system, support periodic effectiveness reviews or prepare the organisation for specific assessment and evidence requirements. The exact subject is agreed in advance; an audit does not provide a blanket guarantee of complete legal compliance.
ISMS Audit and ISO 27001 Audit
An ISMS audit assesses the structure, operation and maturity of an information security management system against the agreed reference framework. In addition to ISO/IEC 27001, BSI IT-Grundschutz or sector-specific requirements may be considered depending on the objective and organisation.
The audit can support preparation for certification but does not replace independent certification. It is equally useful for identifying improvements and prioritising measures without a current certification project.
Compliance Audit
A compliance audit examines a compliance management system or selected processes and controls. Objectives may include assessing responsibilities and policies, tracing the implementation of requirements or evaluating the effectiveness of existing controls.
The laws, standards or internal requirements used as criteria are agreed for the individual audit. This keeps the review focused and its findings practical for the organisation.
Findings and further support
Depending on the engagement, you receive a structured presentation of findings with observations, prioritised gaps and recommended measures. The format and level of detail are agreed before the audit begins.
If required, Robin Data can subsequently support the planning and implementation of improvements. The audit and implementation remain transparently separated phases of work.
Frequently asked questions
Is an audit the same as certification?
No. An internal audit or assessment reviews an agreed subject and presents findings. Formal certification and the associated decision are performed by an independent appointed certification body.
How long does an audit take?
Duration depends on the subject, organisation size, sites, available documentation and number of processes included. Reliable planning is therefore possible only after the scope has been defined.
Which documents are required?
This depends on the audit type. Typical information includes policies, role and process descriptions, risk and action registers, evidence and existing reports. You receive a request list tailored to the agreed subject in advance.
How much does an audit cost?
Cost depends on scope, reference framework, required level of detail and organisational conditions. After the initial consultation, you receive a proposal tailored to your requirements.
In this section
Related offerings
Clarify the audit objective and scope
Discuss the subject, reference framework, available evidence and required outcome with Robin Data. We will use this to propose a transparent scope and approach.
Book a discovery call