As computer technologies develop, the information technology infrastructures that businesses have become increasingly complex. For this reason, it is necessary to determine how safe the system is against the various threats by performing regular inspections and possible attack simulations.
Organizations that use this method use various methodologies and the reports prepared at the end of the studies cover the findings and suggestions for improvement. In addition, verification tests are carried out after the arrangements made in this direction and the measures taken are measured to be effective
. Information security aims to protect information with a simple expression. However, providing information security is a very comprehensive work. For the protection of information, the integrity, confidentiality and accessibility of information must always be provided. System security, physical security,
backup and similar controls must also be in place in order to ensure the security of information from the time of the production of information to the destruction of the information. All kinds of investments are made to computer infrastructures and establishes various security systems to ensure information security and protection of data. Besides, it requires inspections such as penetration tests and weakness analysis. It is not enough to use only the most suitable technology to pass the security audits; The most important point in
the security audits is how to manage information security rather than what technologies are used. A sound control of the foundation by evaluating the existing data, classification, prioritization and creating a threat, risk and control triangle in terms of information assets, Our company provides security audits services to enterprises within the scope of audit services. In this context, our company provides services in accordance with the relevant legal regulations, standards issued by domestic and foreign institutions and generally accepted audit methods. The services offered to businesses within the framework of security audits are mainly as follows:
- Penetration tests
- PCI DSS audits and certification
- Cobit controls
- Customized security audits
- Controls for IT general controls
- Application controls controls
- Technical support controls
With these studies, businesses benefit from all advantages provided by security audits.
As information becomes easier to access, the security of information is now more important. However, in practice, it becomes more and more difficult to ensure the confidentiality of confidential and critical information that is not accessible to anyone, except for information that is approved for access.
Therefore, the environments where the information is stored should be regularly tested by experts acting as aggressors. In this way, the security of the environment will be increased. For example, the purpose of penetration tests is to strengthen the decisions to make the system safer. For example, penetration tests are carried out by simulation tests and the security level and vulnerabilities of the system are revealed in a possible attack. Or weakness scanning is a security scan to determine which of the known security vulnerabilities exist on the client, server, applications, and other devices in the computer infrastructure.
A significant portion of the audit work consists of second party and third party inspections. The second party audit is the audits conducted by the companies that they conduct business with. Businesses are requesting the second party inspection works to review the processes of the suppliers, to examine their activities on the spot, to see their applications, to understand the deficiencies of the application and to correct the process nonconformities with corrective and preventive actions.
Third party audits are the audit of their own processes, production activities and practices by an audit organization, whether or not they are based on a certification work. Businesses require third party audits to understand system implementation levels, to determine their nonconformities, to see how effectively corrective and preventive actions are implemented and to determine the status of their processes and the points to improve.
In this respect, third-party controls have many benefits to businesses. These benefits are listed below:
- The success of the enterprises in various management system applications are determined.
- Nonconformities that the entity cannot identify with its own management and control systems have been identified.
- It is ensured that the corrective and preventive activities of the company are increased and that these are continued more effectively.
- The situation of the activities are analyzed and the points that need to be improved are determined.
- Improvement proposals for the processes and organizational structure offered to the company are implemented.
- With the audits performed and improvements made, the efficiency of the enterprise is increasing.
- In this way, the costs of the enterprise fall down and alternative costs are determined.
- Together with these studies, the prestige and trust of the company in the market is increasing and gaining reputation.
Our company also provides third party inspection services to enterprises within the scope of audit services. In this context, our company provides services in accordance with the relevant legal regulations, standards issued by domestic and foreign institutions and generally accepted audit methods. The services offered to enterprises within the framework of third party inspections are mainly as follows:
- Supplier audits
- Unannounced inspections
- Witness audits
- Confidential customer controls
- Loading controls
With these studies, enterprises benefit from all the advantages of control.
The concept of audit is a concept that is perceived very differently according to the field and activity. In addition to past financial information, the companies also endeavor to be open and transparent in their production activities. In an environment where such rights and rights are increased and maintained, businesses are more concerned than ever, as the products and services produced are within defined criteria and standards, and generally using generally accepted production methods and technologies.
From this point of view, supplier audits, audits and controls carried out in various units of the company and unannounced audits performed in supplier companies, audits performed as confidential customers, loading controls and many more are important in terms of not only generating more quality products and services but also protecting consumer rights and creating customer dissatisfaction. it is.
All certification bodies operate in accordance with the conditions and certification standards of the local or foreign accreditation bodies to which they are accredited. When a certification service is to be taken, it should be noted that the organization is accredited. Essentially accreditation studies are carried out in accordance with the requirements of TS EN ISO / IEC 17021-1 Conformity assessment – Requirements for organizations that provide inspection and certification of management systems – Part 1: Conditions. This standard includes the principles and conditions for the adequacy, consistency and impartiality of organizations that provide supervision and certification of management systems, regardless of the sector in which they operate predominantly.
For certification audits, first of all a certification contract is made with the customer requesting certification service and under this agreement, the customer undertakes to comply with the certification body’s certification rules.
In accordance with the customer’s requirements, the certification body carries out independent audit work on various management systems, product certification (CE marking) and testing and inspection issues, first of all the relevant legal regulations, then within the relevant standards, and if necessary, arranges and delivers the required document.
The certification bodies are responsible for the protection and confidentiality of information that all employees have witnessed. To ensure this, each employee has to make a confidentiality agreement. In the same way, confidentiality of information is also an important undertaking in contracts with customers. The information and documents and the reports issued are only available to authorized persons and are not taken out of the organization in any way.
When information is requested by the authorities to be disclosed to third parties, information is shared under the conditions permitted by legal regulations.
Audit organizations do not have to accept all certification requests from customers. Certification requests are rejected in the following cases:
- Audit organizations do not have to accept all certification requests from customers. Reverting certification requests in the following cases The certification body is not accredited for the requested certification (but still a certification study is performed if the customer requests it):…
- If the certification body and certification decision-makers are not available in the certification body
- If the entity requesting certification has previously worked with another certification body and has not received a certificate,
- If the company requesting certification is known to have difficulty in paying
- If the required organization cannot be made in the region where the company requesting certification
- If the required organization cannot be made in the region where the company requesting certification…
- The certification body may also refuse the application for certification for any reason other than
In general, certification work is carried out in two stages. In the first stage, the documentation studies prepared by the customer are reviewed and the conditions specific to the working environment of the customer are evaluated. In addition, second stage studies are planned. In the second stage, the effectiveness and application of the system are evaluated with the studies performed on site. After this phase is completed, the audit report is prepared.
The review and evaluation process is carried out by the certification body management on this report and it is decided whether the document requesting the certificate is given or the document is used if the interim audit is performed. If there are major or minor non-conformities identified during the studies, a decision is not made before the results are obtained.
The main services provided by the certification bodies within the scope of the audits are:
- ISO 9001: 2015 Quality Management System
- ISO 22000 Food Safety Management System
- ISO 14001 Environmental Management System
- ISO 27001 Information Security Management System
- ISO / TS 16949 Automotive Quality Management System
- ISO 50001 Energy Management System
- OHSAS 18001 Occupational Health and Safety Management System
- ISO 26000 Social Responsibility Management System
- ISO 10002 Customer Complaint and Satisfaction Management System
- ISO 17100 Translation Services Management System
- ISO 3834 (EN 15085) Welded Manufacturing Competency Management System
- HALAL Certificate
- ECOmark® Ecological Product Certification Program