Certified: The GIAC GSTRT Audio Course

In this episode, we focus on auditing as a practical way to reveal drift that quietly undermines the outcomes your policies were written to produce. Drift is rarely loud; it shows up as small exceptions that became normal, controls that are technically present but not used, or procedures that exist but do not match day-to-day reality. When drift accumulates, the organization believes it is protected because the documents look complete, yet the actual behavior and control effectiveness are weaker than intended. Auditing is how you turn that suspicion into evidence, and evidence is what allows you to restore the original intent without relying on opinion or blame. A good audit does not exist to punish teams; it exists to find the gaps that matter most and to guide remediation that reduces real risk. The aim is to test whether the policy outcomes are still being achieved, not whether people can point to a binder. When auditing is done well, it becomes one of the strongest mechanisms for keeping governance honest over time.

Before we continue, a quick note: this audio course is a companion to our course companion books. The first book is about the exam and provides detailed information on how to pass it best. The second book is a Kindle-only eBook that contains 1,000 flashcards that can be used on your mobile device or Kindle. Check them both out at Cyber Author dot me, in the Bare Metal Study Guides Series.

Start by defining scope clearly, because an audit that tries to cover everything usually produces shallow results that do not change decisions. Scope should include the documents being assessed, the processes that implement them, the evidence that proves behavior, and the results that indicate outcomes. Document scope is which policies, standards, procedures, and guidelines are in play and which versions are considered authoritative. Process scope is which workflows the audit will examine, such as access requests, change approvals, patching, incident response handoffs, or exception management. Evidence scope is what artifacts will be considered proof, such as system logs, tickets, approvals, access reviews, or configuration states. Results scope is what outcomes you expect to observe, such as reduced stale privileges, consistent logging retention, or timely remediation of critical findings. Clear scope also defines what is out of scope, which protects the audit from expanding into a never-ending exploration. The more precise the scope, the easier it is to produce findings that lead to action. In mature programs, scope is chosen to test the most risk-relevant policies first, rather than chasing everything equally.

Once scope is set, build test plans aligned to control intent, because intent is the only stable reference when documents and tooling evolve. Control intent is what the control is trying to prevent or enable, such as preventing unauthorized access, preserving evidence quality, or reducing exposure time. A test plan should translate intent into observable questions, such as whether privileges are reviewed and reduced, whether exceptions are time-bound with compensating safeguards, or whether incident logs are available and complete when needed. This is where many audits go wrong, because they test for artifact presence rather than control effect. Artifact presence is useful, but it is not enough, because a control can exist in name while failing in behavior. A strong test plan includes both compliance checks, which validate objective requirements, and effectiveness checks, which validate whether behavior and outcomes match intent. It also defines what evidence will satisfy each test, so results are consistent across auditors. When the test plan is intent-driven, you can detect drift even when teams are technically compliant on paper.

Sampling across teams and time periods thoughtfully is critical because drift often appears unevenly. If you sample only one team, you may confuse a local issue for a program issue, or you may miss widespread gaps that are present elsewhere. Sampling across time periods matters because compliance often spikes near audits and fades afterward, and you want to see whether behavior is durable. A thoughtful sample includes different maturity levels, different operating models, and different system criticality classes, because controls can behave differently in each context. Sampling also needs to be large enough to reveal patterns but small enough to be executed with quality. In practice, it is often better to sample fewer areas more deeply than to sample many areas superficially. Depth matters because it reveals how work actually happens, including the informal decision points that documents rarely capture. When sampling is disciplined, findings are easier to defend and remediation is easier to prioritize. A weak sample leads to disputed findings, and disputed findings lead to delayed fixes.

Comparing expected behaviors against observed practices is the heart of the audit, because this is where you see whether governance is being lived or merely referenced. Expected behaviors are what a policy and its supporting standards and procedures imply people will do, such as completing access reviews on a defined cadence, routing exceptions through approval, or applying patches within a service level. Observed practices are what actually happens, which you can discover through evidence trails, interviews, and observation. The comparison should focus on behaviors that matter to outcomes, not on minor formatting differences or stylistic inconsistencies. When you find divergence, you should ask whether the document is unclear, the process is unrealistic, the tooling is insufficient, or incentives are misaligned. This prevents the audit from defaulting to blaming the team, because divergence is often a system design problem. The goal is to isolate the mechanism of drift, because fixing the mechanism prevents recurrence. When you compare expected to observed with discipline, your findings become both credible and actionable.

A concrete example is privileged access recertification lag, which is a common gap because it feels administrative and gets deprioritized under delivery pressure. The intended outcome of recertification is to reduce stale privileges and ensure that only currently justified access exists, which reduces blast radius and misuse risk. The expected behavior is that owners review privileged access on a defined schedule, remove what is no longer needed, and document decisions. Observed practice might show that reviews are completed late, that approvals are rubber-stamped without meaningful review, or that access removal is delayed due to workflow friction. Evidence might show backlogged review tasks, repeated renewals, or access lists that have not changed for long periods despite staff movement. This is drift because the process exists, but the outcome is weaker than intended. The remediation might include tightening ownership, automating reminders, simplifying evidence, or improving identity tooling that makes review easier. The key is that the audit finding is not simply that a review was missed, it is that the risk reduction intent is not being achieved. That framing supports stronger fixes than a simple compliance reminder.

Once gaps are found, quantify severity, likelihood, and potential impact so remediation prioritization is defensible. Severity describes how harmful the gap could be if exploited or if failure occurs, such as whether it exposes sensitive systems or creates a credible path to high-impact loss. Likelihood describes how probable the harm is given current threat and operational conditions, including whether the gap is widespread and whether attackers or failures would plausibly exploit it. Potential impact describes the business consequences, such as downtime, data exposure, regulatory breach, or customer trust damage. Quantification does not need to be a complex model, but it must be consistent and clear enough that leaders can compare findings. This also helps avoid politics, because prioritization becomes about risk and impact rather than about which team has the loudest voice. Quantification should also consider detectability and time-to-exploit, because a gap that is hard to detect can be more dangerous even if it seems unlikely. When findings are quantified consistently, leadership can allocate resources rationally and track whether the most important gaps are closing. This is what turns audits into operational improvement rather than into compliance rituals.

A major pitfall is checklist compliance masking broken outcomes, where teams meet the letter of a requirement but the control effect is missing. This happens when audits focus on whether a document exists, whether a checkbox was clicked, or whether a form was filled, without testing whether the behavior actually reduced risk. It also happens when metrics are gamed, such as by completing reviews without removing stale access or by creating tickets without actually remediating risk. The remedy is to test intent, asking what change in the environment proves the control is effective. For example, instead of verifying that access reviews were completed, verify that access is actually being reduced and that stale privileges are being removed. Instead of verifying that incident response procedures exist, verify that teams can execute them under time pressure and that evidence quality supports investigations. Checklists are not useless, but they are incomplete, and relying on them alone creates false confidence. False confidence is dangerous because it delays investment in real fixes until an incident exposes the gap. The audit should therefore include effectiveness checks that cannot be satisfied by paperwork alone.

A quick win after an audit is publishing the top three remediation themes, because themes help the organization focus on systemic fixes rather than chasing a long list of isolated findings. A theme might be that ownership is unclear, that tooling does not support compliance efficiently, or that exception management is drifting into default behavior. Publishing themes helps leaders understand the underlying causes and align support, because systemic issues often require cross-team action. Themes also reduce defensiveness because they shift attention away from individual mistakes and toward program-level improvements. The themes should be written in plain language and should include the intended outcome they support, so stakeholders see why the work matters. You can also link themes to specific actions, such as clarifying decision rights, automating evidence collection, or simplifying procedures. When themes are visible, teams can contribute fixes proactively rather than waiting for findings assigned to them. This accelerates improvement because it creates shared direction. A focused set of themes is often the difference between an audit that produces lasting change and an audit that produces temporary compliance bursts.

Consider a scenario where a failed tabletop reveals cross-team misalignment, because tabletops are a powerful way to test whether policies and procedures actually coordinate people under stress. A tabletop failure might show that one team assumes another team owns a decision, or that escalation paths are unclear, or that evidence needed for a policy requirement is not available during an incident. This kind of failure is especially valuable because it reveals drift in coordination, not just drift in control configuration. The audit response should treat the tabletop as evidence that the process is not executable as written, which means the governance artifacts and operating model must be adjusted. Remediation might include clarifying roles and decision checkpoints, updating procedures to reflect actual tooling and handoffs, and establishing stronger cadence for cross-team reviews. It might also include updating policy exception paths for emergency conditions, because stress reveals where rigid rules break. The key is to capture the misalignment as a clear finding tied to outcomes, such as delayed containment or inconsistent communication. When you fix misalignment, you improve resilience across many scenarios, which is high leverage risk reduction.

A practical exercise is writing one probing audit interview question that tests intent rather than paperwork. A strong question invites the interviewee to describe what actually happens, and it reveals whether the control is integrated into real workflow. For example, you might ask how a team decides to remove privileged access during recertification when there is uncertainty, and what evidence they rely on to make that decision. This question forces discussion of decision-making, evidence, and action, not just whether a review was completed. Probing questions should be non-threatening, focused on process, and open enough to reveal friction points. They should also be specific enough that vague answers are hard to sustain, because vague answers often indicate a gap. Good interview questions also help identify whether documentation is unclear or whether incentives discourage compliance. When you practice writing probing questions, your audit program becomes more effective because interviews become a source of operational truth rather than a formality. Interviews are where you learn why drift happens, which is what you must fix.

Keep a simple memory anchor: test intent, not paperwork alone. Paperwork is evidence, but it is not the outcome, and an audit that stops at paperwork can be satisfied by theater. Intent testing means you ask what the control is supposed to achieve and whether the environment shows that achievement. It means you validate behaviors, decision paths, and real effects, not just forms and timestamps. This anchor also helps you prioritize findings, because gaps that break intent are usually more important than cosmetic documentation issues. It keeps the audit focused on risk reduction rather than on administrative perfection. When auditors and stakeholders share this anchor, audit conversations become more constructive, because everyone understands that the goal is stronger outcomes, not blame. It also helps teams accept findings, because findings tied to intent feel fairer and more meaningful. Over time, this approach builds a culture where compliance supports effectiveness rather than replacing it.

As a recap, effective audits start with clear scope that covers documents, processes, evidence, and results, so the assessment is focused and actionable. Test plans must align to control intent, translating outcomes into observable checks that include both compliance and effectiveness. Sampling across teams and time periods reveals patterns and avoids the false comfort of one snapshot. Comparing expected behaviors against observed practices exposes drift mechanisms and guides systemic remediation. Findings are strengthened by quantifying severity, likelihood, and potential impact so prioritization is defensible and risk-based. Avoid checklist-only auditing because it can mask broken outcomes and create false confidence. Publish a small set of remediation themes to focus effort on systemic improvements, and use scenario-based evidence like tabletops to reveal cross-team misalignment. Probing interview questions help surface operational reality and uncover why controls drift. When these elements are consistent, audits become a loop that restores intent and improves resilience, not a ritual that produces paperwork.

To conclude, assign owners for each high-impact finding, set deadlines that match risk, and track fixes to closure so the audit produces real change. Ownership should be explicit, with decision rights and resources aligned so the fix is feasible. Tracking should include verification, meaning you confirm the remediation actually restored the intended behavior and outcome, not just that a document was updated. Where findings reflect systemic themes, assign program-level owners who can coordinate cross-team fixes rather than scattering responsibility. Communicate progress transparently so stakeholders see that the audit is driving improvement, which increases willingness to participate honestly in future audits. If a finding cannot be fixed quickly, manage it through time-bound exceptions with compensating safeguards, rather than letting it drift silently. When you close the loop this way, auditing becomes one of the strongest tools you have for restoring intended outcomes and preventing governance decay over time.