Audit methodology
Client relationship · Risk expertise · Business context
COMPASSMenu
AUDIT & TECHNOLOGY RISK
Specialist technical insight for audit and risk teams.
Governance and controls provide critical visibility. Blue Top examines the underlying software when the engagement needs deeper evidence about software condition, delivery capability or technical risk.
Discuss an engagement →Extend the engagement without building a software-engineering team.
Software engineering
Architecture · Technical examination · Engineering evidence
Management-ready technical findings
Technical evidence connected to risk, delivery and remediation decisions.
Technical examination supports professional judgement. It does not replace it.
Compass provides observations and supporting evidence. The auditor or practitioner determines relevance, evaluates controls and reaches any audit, risk or assurance conclusion. Compass does not issue an audit opinion or certify compliance.
Observations first. Conclusions second.
Compass separates what was directly observed from what the evidence only indicates, so stronger conclusions are not drawn from weaker signals.
Observed
Directly established from the available evidence.
Indicated
Evidence suggests a condition, but further context may be required.
Not assessed
The available evidence is insufficient for a reliable conclusion.
Assessment activity
The activity used depends on what can be tested safely and what authority has been provided.
- Passive observationRecords signals visible during ordinary public application access.
- Safe probeUses a tightly bounded request or interaction to verify a specific observable condition.
- Authorised assessmentReserved for work that requires explicit authority, additional access or specialist examination.
