Cyber Security Audit vs Risk Assessment: What NZ Businesses Actually Need
A client sends you a security questionnaire. Your insurer wants evidence before renewal. Or you simply want to know how exposed your business really is. Somewhere along the way, someone says you need a “cyber security audit”.
It’s a reasonable request, but the term gets used for at least four different things. Each answers a different question and produces a different report.
The short answer: a cyber security audit checks your security against a defined standard and tells you where you fall short of it. A cyber security risk assessment works out which threats matter most to your business and what to fix first. Most New Zealand businesses that haven’t had either should start with a risk assessment.
Here’s how to tell them apart, and which one fits your situation.
The four things people mean by “audit”
1. A cyber security audit
An audit measures your controls against a specific benchmark, such as ISO 27001, the NIST Cybersecurity Framework, the Essential Eight or a client’s own requirements. The auditor gathers evidence (policies, configurations, logs, interviews) and records whether each requirement is met.
The result is a statement of conformance: which controls you meet, which you don’t, and what evidence supports each. That’s exactly what you want when someone else has set the bar. It’s less useful when you don’t yet know which bar matters to you.
One point that often causes confusion: if you’re pursuing ISO 27001 certification, the certification audit itself must be done by an accredited certification body. A consultant can prepare you for that audit, but can’t certify you.
2. A cyber security risk assessment
A risk assessment starts from your business rather than a checklist. It looks at what you hold, how you work, who might target you and how, and then ranks the gaps by likelihood and impact.
The result is a prioritised list: what could actually hurt you, and what to fix first, second and later. A good risk assessment still maps its findings to a recognised framework, so the work counts towards compliance later. Its job, though, is to tell you where to spend your next dollar, not to give you a pass mark.
3. A vulnerability scan
A vulnerability scan uses automated tools to look for known weaknesses in your systems: missing patches, outdated software, misconfigured services and exposed ports. Scans are fast and repeatable, which makes them ideal for running regularly to catch new issues as they appear.
A scan finds possible weaknesses. It doesn’t confirm whether an attacker could actually use them, and it doesn’t look at your policies, people or processes.
4. A penetration test
A penetration test goes a step further. A tester actively tries to exploit weaknesses, the way a real attacker would, to show what could actually be reached. It answers the question “could someone get in, and how far could they go?”
Pen tests are focused and point-in-time. They’re most valuable once the basics are in place, or when a client, insurer or regulator specifically asks for one.
Which one does your business need?
Work from the question you’re trying to answer, not the label someone used.
| Your situation | Start with | Why |
|---|---|---|
| You don’t know where your biggest gaps are | Risk assessment | It tells you what matters most before you spend on fixes or certifications |
| A client or tender requires a specific standard | Audit against that standard (often after a risk assessment) | You need evidence against their requirements, not just general advice |
| You’re aiming for ISO 27001 certification | Gap analysis and preparation, then a certification audit by an accredited body | Certification can only come from an accredited auditor |
| Your insurer or a client asks for proof your systems are tested | Penetration test | It shows what an attacker could actually reach |
| You want to catch new weaknesses as they appear | Regular vulnerability scanning | It’s quick, repeatable, and good at spotting drift between bigger reviews |
| You’ve just had an incident | Incident response first, then a risk assessment | Contain the problem first, then find out what let it happen |
If you’re still unsure, a risk assessment is rarely the wrong first step. Its findings tell you whether an audit, a pen test or regular scanning should come next, so you don’t pay for the wrong one.
Want a feel for where you stand before talking to anyone? Our free SMB Cyber Readiness check and NIST CSF Lite assessment take a few minutes. They’re self-reported indicators, not audits, but they’re a useful starting point.
What a good assessment or audit should give you
Whichever you choose, judge it by what you get at the end. A useful report should include:
- Findings ranked by risk, not a flat list of every issue found. You should be able to see what to fix this week and what can wait.
- Plain-English explanations of why each finding matters to your business, not just a technical reference number.
- Effort and cost estimates for each fix, so you can plan and budget.
- Mapping to a recognised framework such as NIST CSF 2.0 or ISO 27001, so the work counts towards future compliance or certification.
- An executive summary your board or management can read in five minutes.
- A walkthrough session, where someone explains the findings and answers your questions.
- A clear scope, in writing, before work starts. You should know exactly what was and wasn’t examined.
Be wary of a report that’s mostly the raw output of a scanning tool, or one that recommends a large purchase without explaining the risk it addresses.
A note on the Privacy Act
Under the New Zealand Privacy Act 2020, organisations must take reasonable security safeguards to protect the personal information they hold. They must also notify the Privacy Commissioner and affected people about a privacy breach that has caused, or is likely to cause, serious harm. Neither an audit nor a risk assessment is a legal requirement in itself. They are, though, one of the most practical ways to show you’ve taken “reasonable” steps, and to find weaknesses before they turn into a notifiable breach.
After the report: keeping it current
Any assessment is a snapshot. New staff join, new software arrives, settings drift, and new vulnerabilities are published every week. What matters is what happens in the months after the report.
There are two common ways to keep things moving:
- Managed security. Our Managed Security service includes an annual risk assessment and quarterly vulnerability scanning. The Business tier adds 24/7 monitoring and an annual penetration test, so the checks above happen on a schedule rather than when someone remembers.
- A virtual CISO. If you need someone to own the roadmap, report to your board and answer client security questionnaires, a virtual CISO gives you senior security leadership a few days a month, without a full-time hire.
If a specific framework is the goal, our Compliance service covers gap analysis, remediation planning and audit preparation.
How a KIS risk assessment works
Our risk assessment is built for businesses that want a clear, honest picture without the jargon:
- Scoping call (30 minutes). We agree what’s in scope and confirm the timeline before anything begins.
- Assessment (3 to 5 business days). We review your systems, configurations and policies against NIST CSF 2.0, ISO 27001 controls and the NZ Information Security Manual, using read-only access.
- Report. Findings are ranked by risk, each with effort and cost estimates, plus an executive summary for your board or management.
- Walkthrough (60 minutes). We go through every finding with your team and explain what to do first.
Frequently asked questions
Is a cyber security audit the same as a risk assessment? No. An audit checks your security against a defined standard and records whether you meet it. A risk assessment identifies the threats most relevant to your business and ranks what to fix first. Many businesses start with a risk assessment, then audit against a standard once they know which one matters.
How often should we have one? At least annually, and after any major change, such as a move to the cloud, a merger, a new system that holds customer data, or an incident. Vulnerability scanning should run far more often, ideally every quarter or more.
Do we need an IT team to get a risk assessment? No. Most of our clients don’t have a dedicated security team. We need about an hour of your time, access to whoever looks after your systems, and read-only access where required.
Will a risk assessment get us ISO 27001 certified? Not by itself. Certification comes from an audit by an accredited certification body. A risk assessment mapped to ISO 27001 is, however, a practical first step towards it.
Not sure where to start?
Tell us what’s prompting the question: a client request, an insurance renewal, or just wanting to know where you stand. We’ll tell you honestly whether you need an audit, a risk assessment, a scan or a pen test, and what you don’t need yet.
