Illustrative stock imagery from Pexels. Images do not identify the people, premises or events discussed and do not imply endorsement.
Reviewed 26 October 2026. Original publication date retained: 2023-02-24.
Information-security assurance depends on understanding the information, its use and the people who can access it. A certificate is not a guarantee that a breach cannot occur or that every legal obligation has been met.
Questions to follow in an audit
- How is sensitive information identified within the agreed scope?
- Who approves access and reviews whether it remains necessary?
- How are incidents and exceptions investigated and followed up?
Connect the records with practice
Trace one information asset through its owner, access decisions, operating evidence and review of an identified weakness.
These are illustrative audit trails, not findings about a named organisation, technical instructions or a guarantee of a particular result. The appropriate evidence depends on the activities, risks and agreed scope. The organisation remains responsible for its operations and legal obligations.
AAA provides independent certification audits. Confirm the applicable standard edition, scope and customer requirements before agreeing a programme. Request an indicative price or discuss your proposed audit.
Further reading: ISO information security.