PCI DSS internal audit and the ISA: how to test your own controls

Does PCI DSS require an internal audit?

Not in the form ISO standards use the term. ISO/IEC 27001 and ISO 9001 each carry a clause titled internal audit that asks for a planned programme, criteria, competent and objective auditors and reported results. PCI DSS v4.0.1 has no equivalent requirement, and no single annual event that satisfies it.

Instead, PCI DSS spreads testing across the year. Many requirements carry their own frequency, from daily log review to quarterly scans and yearly scope confirmation; each is a small test of a control that must leave evidence. Together they are your self-testing programme.

The real question is how to prove, at any point in the year, that the periodic tasks ran, that someone independent checked them and that what was found was fixed.

What self-testing looks like in a PCI DSS programme

Business-as-usual control checks

The control owner performs the recurring tasks the requirements set: scans, log reviews, access reviews, terminal inspections, change records. The self-test is the step after, when someone confirms each task ran on time, to procedure, with exceptions followed up.

Quarterly reviews for service providers

A service provider must, at least once every three months, review whether personnel are performing their tasks in line with the security policies and operational procedures. The standard lists the areas the review covers, among them daily log reviews, configuration reviews of network security controls, applying configuration standards to new systems, responding to security alerts and change management. The review is carried out by someone other than the person responsible for the task, and the record shows the results, the remediation for anything not performed and sign-off by whoever is accountable for the PCI DSS compliance programme. Merchants are not bound by it, but copying its discipline is the surest way to show periodic tasks did not slip.

A pre-assessment internal assessment

Before the QSA arrives, or before an executive signs an SAQ, every requirement in scope is tested against its evidence as an assessor would test it, while there is still time to close what surfaces.

These are the headline frequencies; some requirements let a targeted risk analysis set the interval. The detail is in PCI DSS requirements explained, requirement by requirement, and how the calendar repeats each year is in The PCI DSS annual cycle.

The Internal Security Assessor programme

The ISA is a PCI Security Standards Council qualification held by an individual employee, whose employer applies to the programme and sponsors them. Candidates need substantial security assessment experience and complete a fundamentals course and exam before the ISA training. The qualification has to be renewed every year.

Once qualified, an ISA can perform internal assessments for their own company, recommend remediation and act as the organisation's point of contact with the QSA, speaking the assessor's language on testing procedures and evidence.

Whether an ISA can go further, completing or signing the validation document in place of a QSA, is not the Council's decision. The card brands set the validation rules, and your acquirer applies them. The Attestation of Compliance has a place to record ISA involvement, but that does not grant the right to use one. Ask your acquirer in writing before you plan around it, and see PCI DSS validation step by step: ROC, SAQ and AOC for how the routes work.

For a small merchant on a short SAQ, a trained internal reviewer and a sound calendar usually give the same assurance at far less effort. Role-based training for reviewers is covered in PCI DSS training: who needs what.

Independence and competence of the people who test

Self-testing fails most often because the person checking a control is the person who runs it. The quarterly review requirement for service providers says so directly by requiring a different reviewer, and the same principle should govern every layer.

Where full separation is not possible, cross over: network staff check access reviews, the service desk checks change records, and the compliance owner re-performs a sample. Record who reviewed what.

Competence matters as much. A reviewer who can only confirm that a document exists will pass a control that is failing; they need to know the testing procedure and what acceptable evidence looks like. Keep a record of each reviewer's training.

Sampling and the record the assessor relies on

Sampling is expected, but it has to be justified. Group systems that are genuinely managed the same way, sample each group, and include the awkward items: the new system, the privileged account, the emergency change. Write down how the sample was chosen and why it represents the population. If an item fails, widen the sample.

The QSA draws their own sample, but yours lets you find the outlier first.

The record of each test should show, at a minimum:

• the requirement and the control tested, and the period covered;
• the population and how the sample was drawn;
• what was examined, observed or asked, and by whom;
• the result for each sample item, with the evidence attached or referenced;
• any failure, its cause, the fix, the owner and the date it was confirmed closed;
• sign-off by the compliance programme owner.

Where a control genuinely cannot be met as written, the route is a documented compensating control or the customised approach, covered in PCI DSS compensating controls and the customised approach.

How self-testing differs from the QSA assessment

What the QSA tests and how fieldwork runs is the subject of The PCI DSS assessment: what a QSA tests, and how. The assessor will read your self-testing records as evidence that periodic requirements were met all year.

PCI DSS internal audit and the ISA: questions buyers ask