Compliance Audits
Framework-anchored gap analysis engagements that produce a defensible read on the difference between stated controls and operational reality, with a remediation roadmap sequenced for execution before a formal audit window opens.
A compliance audit produces a defensible read on the gap between an organization’s stated controls and operational reality, framed against a specific framework: NIST CSF, NIST SP 800-53, CIS Controls v8, ISO 27001, the HIPAA Security Rule, the SOC 2 Trust Services Criteria, or the GLBA Safeguards Rule. Aegis & Spear runs these engagements for organizations preparing for a formal audit in the next six to twelve months, recovering from a recent audit finding, or seeking to know the actual operational gap before the auditor does. The deliverable is a gap analysis with a prioritized remediation roadmap, not a formal audit attestation. The firm is not a SOC 2 auditor and does not pretend to be. The engagement is structured so the output is something a CPA firm, a compliance officer, or an IT leadership team can actually execute against before the formal audit window opens.
What’s in scope
Compliance audit engagements are scoped against one framework, or against a coherent multi-framework set where the organization’s regulatory exposure warrants it. The framework choice and the scope are fixed before active work begins.
Framework selection. The framework set is driven by actual regulatory exposure, not by what’s convenient to assess. Healthcare environments anchor on the HIPAA Security Rule. SOC 2 candidates anchor on the Trust Services Criteria. Financial services organizations anchor on the GLBA Safeguards Rule. Defense industrial base organizations anchor on NIST SP 800-171 and CMMC. Multi-framework engagements (a healthcare client preparing for HIPAA plus SOC 2, for example) get cross-walked so common controls are assessed once rather than twice.
Documentation review. Existing policies, procedures, standards, and supporting documentation are reviewed against the chosen framework’s control requirements. The review identifies where documented controls exist, where they don’t, and where documented language is generic enough that an auditor will push back on it.
Control-by-control assessment. Each framework requirement is assessed against current organizational practice. Configuration evidence is sampled where the control is technical (identity, endpoint, network, logging, backup). Interview-based assessment is used where the control is operational (incident response procedures, change management, third-party risk).
Documentation-versus-practice gap. The highest-leverage finding class in most engagements. Organizations frequently have written policies that operational practice doesn’t follow, and that gap is what the auditor will find. The engagement surfaces those gaps before the auditor does so they can be remediated rather than reported.
Deliverable scope. A written gap analysis report keyed to the framework, a prioritized remediation roadmap, and a debrief with client leadership. A letter of attestation confirming engagement completion is available on request. Industry-specific references (ABA cyber guidance for law firms, AICPA and IRS Pub 4557 for accounting firms, CMMC and NIST SP 800-171 for defense-adjacent organizations) are layered into the report where the client’s regulatory environment warrants them.
How engagements actually run
Engagements run in three phases against a defined timeline. Pre-engagement covers framework selection, scope confirmation, evidence-collection logistics, escalation contacts, and the explicit timeline. Where multiple frameworks apply, the cross-walk is mapped before active work begins so common controls are assessed once.
Documentation review and control mapping is the first active phase. Existing policies, procedures, and supporting evidence are mapped against the framework requirements. Gaps in documentation are identified, and language that won’t survive auditor scrutiny is flagged. The output of this phase is a documentation-side gap inventory that informs which controls need operational evidence collection and which need policy work.
Operational assessment is where the engagement does its highest-leverage work. Configuration evidence is sampled across in-scope systems where the control is technical. Interview-based assessment is conducted with control owners where the control is operational. The job at this phase is to surface where the documented control diverges from operational reality, because that divergence is what produces audit findings.
Gap analysis and remediation roadmap is the synthesis phase. Findings are cross-walked to the chosen framework, prioritized by effort and impact rather than by framework control number, and sequenced so the organization can execute against them. Quick-fix findings (configuration changes, policy language updates, evidence-collection process changes) are separated from organizational-change findings (governance structure, third-party risk program, formal training program) so leadership can plan accordingly.
Reporting delivers the gap analysis, the remediation roadmap, and a debrief call with client leadership to walk findings and prioritization. The firm’s approach covers engagement mechanics in more depth across all service lines.
What makes this engagement different
Two things distinguish this engagement from a commodity compliance review.
The first is scope discipline. This is a gap analysis engagement, not an audit attestation. The firm is not a SOC 2 auditor, a HIPAA covered-entity assessor, or an ISO 27001 certification body, and the page is explicit about that because the distinction matters at audit time. The deliverable is structured so the organization can hand it directly to a CPA firm running a formal SOC 2 audit, to ABA-recommended counsel reviewing law firm cyber posture, or to internal compliance preparing for the next audit cycle. Pretending to provide attestation when the firm cannot is the kind of misalignment that produces real problems for the client downstream. The engagement does not do that.
The second is remediation orientation. The remediation roadmap is sequenced by effort and impact, not by framework control number. A roadmap organized by control number reads as a thoroughness exercise. A roadmap organized by what to fix first, because that’s what produces the most audit-readiness for the least operational lift, reads as practical guidance. Small-team IT and compliance functions tend to have one or two people working remediation against their other responsibilities, and the roadmap is built around that operational reality.
What good outcomes look like
At engagement close, the client has a defensible read on the gap between stated controls and operational reality, mapped against the framework that governs them. The gap analysis identifies each control with a status (in place, partially in place, gap, not applicable) and an evidence reference. The remediation roadmap sequences findings by effort and impact, identifies which findings can be closed before a formal audit window opens, and identifies which require longer-cycle organizational change.
The deliverable includes the written gap analysis report keyed to the chosen framework, the underlying evidence the findings are drawn from, the prioritized remediation roadmap, and a debrief call with client leadership and any retained external counsel or auditor preparing for the subsequent formal review. A letter of attestation confirming engagement completion is available on request.
A compliance audit does not make the organization compliant, and a gap analysis does not substitute for a formal audit. The deliverable is preparation. What it produces is the kind of read on operational posture that lets a compliance officer answer the questions the auditor is going to ask, lets IT leadership prioritize remediation spend against actual audit risk, and lets executives know whether the organization is ready for its scheduled formal audit or whether the audit needs to be deferred.
Findings frequently surface specific gaps that justify follow-on engagement: penetration testing where the technical control evidence is thin, social engineering assessment where the human-layer controls are untested, or hygiene work where a broader baseline view is needed before deeper compliance investment.
Who this fits, and who it doesn’t
This engagement fits organizations preparing for a formal audit in the next six to twelve months and seeking to identify the gaps the auditor will find, organizations recovering from a recent audit finding and seeking to close the gap before the next cycle, organizations with multi-framework regulatory exposure that want a coherent view of how the same operational controls perform against each framework, and organizations with existing documentation that may or may not match what’s happening in practice.
This engagement does not fit organizations seeking formal SOC 2 attestation or any other certification (a CPA firm or appropriate certification body is required for that), organizations with no existing security documentation at all (foundational policy work needs to come first), or organizations seeking a compliance stamp without the intent to remediate identified gaps. Aegis & Spear declines engagements where the operating intent is to produce a clean deliverable rather than to identify and close real gaps.
Talk to us
If you are considering a compliance audit, reach out at contact@aegisandspear.com. Useful context in a first message: the framework or frameworks in question, the timeline driver (formal audit window, recent finding, contract requirement, regulatory change), the rough size of the organization, and whether existing security documentation is in place. Response within two business days. The contact page covers initial outreach in more depth.