Internal audit of controls: stages and deadlines
An internal audit of controls in data protection and security runs through five defined stages, from scoping to closure of findings. In practice it takes eight to twelve weeks, depending on how many systems, vendors and business units sit inside scope. The audit ends at a formal closure report, not at the last interview with a process owner.
What triggers the audit
Most internal audits of controls start for one of three reasons: a governance calendar requirement, a contractual audit clause from a customer or partner, or a response to an incident that exposed a gap. None of these triggers changes the shape of the procedure. What changes is who commissions it and how much authority the audit team is given from day one.
A board-mandated audit carries more weight than one requested by a single department. It gets faster access to logs, faster sign-off on interviews, and a shorter path to escalation if a business unit refuses to cooperate.
What changes once the audit starts
Once the audit is opened, the practical effect is immediate: change requests to the affected systems slow down, because any configuration change during the audit window has to be logged and explained separately. Teams that were used to informal fixes now need a paper trail.
If the scope touches technology contracts with source-code dependencies, the audit team usually checks whether existing safeguards are adequate before relying on them as evidence. Escrow set-up technology contract is one of the arrangements reviewed at this point, because a stale or unfunded escrow undermines the control it is meant to demonstrate.
Vendor contracts get pulled forward for review too. A control that depends on a supplier's own audit rights is only as strong as the last time that right was exercised.
Stages and typical duration
| Stage | Who runs it | Typical duration |
|---|---|---|
| Scoping and mandate | Audit lead with sponsor sign-off | 3–5 working days |
| Evidence collection | Audit team, system owners | 2–4 weeks |
| Interviews and walkthroughs | Audit team, process owners | 1–2 weeks |
| Draft findings and challenge | Audit lead, department heads | 1–2 weeks |
| Closure and remediation plan | Sponsor, audit lead | 1 week |
These durations assume a single organisation and a manageable number of systems. Cross-border groups running the audit across Lithuania and Estonia at once should expect the evidence-collection stage to run longer, since local system owners rarely respond on the same schedule.
What to do first
- Sponsor confirms the mandate in writing, including which systems and units are in scope.
- Audit lead requests the control inventory and the last remediation log from the compliance function.
- Evidence owners are named for each control, one person per control, not a team.
- A cut-off date is set for evidence submission, communicated to all owners at once.
- Where the audit intersects with licensing arrangements, the team checks whether royalty flows have already cleared their own review. How tax clearance for royalty flows IP licence runs shows how that separate procedure tends to run in parallel.
- Draft findings circulate to owners before the closure meeting, never after.
Who decides and when it closes
The sponsor decides scope changes; the audit lead decides which findings are material enough to escalate. Closure happens when the sponsor signs the remediation plan, not when the last finding is resolved. A finding can stay open past closure if it has an agreed deadline attached.
Where the audit precedes a fundraising step or a token issuance, the decision maker reviewing the closure report is often the same person who later signs off the offering document. Offering document preparation step by step in practice sets out what that reviewer looks for once the audit trail is in hand.
If the picture changes mid-audit
If a business unit stops responding to evidence requests, the audit lead escalates to the sponsor in writing, with a fixed deadline for a reply. Silence past that deadline is treated as a finding in itself, not as a delay to be absorbed.
If the audit uncovers a live dispute over a product feature that is also under redesign, the audit does not pause for the dispute. When the product is redesigned mid-dispute: the deadline that matters most is usually independent of the audit's own timeline, and the two should not be merged into one deadline by accident.
If a control depends on a system due for replacement within the audit window, the audit team notes the replacement date and tests the outgoing system as it stands, not the plan for the new one.
Factors that change the timeline and the effort
The duration in the table above moves with a small number of factors: how many jurisdictions the group operates in, how many vendors hold a piece of the control, whether an incident already forced part of the evidence into existence, and whether a business unit has an incentive to slow the process down. An audit with one system and one owner closes inside four weeks. An audit spanning several entities and an unresponsive unit can run past twelve.
What this page does not cover
This page describes the internal procedure, not any statutory audit obligation that might sit alongside it, and not the internal report grading used once the audit is complete. It does not set out how findings should be priced or resourced once remediation begins. Those questions depend on the scope agreed at the first stage, not on the procedure itself.
Verified
Last reviewed: June 2025. This page describes an internal governance procedure. It does not rely on a named statutory provision, because the audit itself is set up by internal charter and sponsor mandate rather than by a specific external rule.
Related reading
Certification readiness: stages and deadlines covers the parallel procedure most groups run once the audit itself has closed.
Frequently asked questions
How long does an internal audit of controls take in practice?
Eight to twelve weeks for a single organisation with a manageable number of systems. Cross-border scope or an unresponsive business unit extends this, sometimes past three months.
Which documents are needed to start?
A written mandate from the sponsor, the current control inventory, and the log from the last remediation cycle. Without these three, scoping cannot begin properly.
What happens if a business unit does not respond to audit requests?
The audit lead escalates to the sponsor in writing with a fixed reply deadline. Continued silence is recorded as a finding, and closure proceeds without that unit's input if the deadline passes.