4 MIN READ
Here is the difference in one sentence. A checkbox audit is a tickbox exercise run to satisfy a framework. An honest audit is a forensic look at where the controls will fail when something real goes wrong. The first is about getting the report. The second is about what the report actually contains.
The 2026 audit market has three rough tiers, and the honest audit lives or dies on the person doing the work, not on the firm. The big 4 (Deloitte, PwC, EY, KPMG) handle the SOC 2 and ISO 27001 for the public companies, with engagement costs running from $200K to $1M depending on scope. Boutique shops (Coalfire, Schellman, A-LIGN, Linford) cover SOC 2 and PCI for the mid market, typically $50K to $200K. Independent assessors handle smaller engagements, anywhere from $10K to $50K. Same caveats at every tier. Most engagements default to checkbox. A serious assessor is a rare find at any of them.
What the checkbox audit looks like
Five patterns show up in almost every checkbox engagement, in roughly the order of how often they appear. First, the questionnaire gets filled in with the answers the company wants seen, and they accept them on the questionnaire’s terms. Then the evidence theatre: screenshots of controls that look right in the report but were never tested live. Scope gets negotiated down to the systems that would pass any meaningful test, which is to say the audit never covers the parts most likely to fail. Findings get minimised in the working sessions. Real issues become recommendations, recommendations get ignored, and the next year’s audit finds the same problem with a new recommendation attached. The fix follows the letter of the finding, not the spirit, so the underlying issue produces the same finding again twelve months later. None of this is a secret. It is how checkbox audits get done.
What the honest audit looks like
An honest audit flips the pattern. Sample testing instead of questionnaire: the assessor picks the controls, tests them, and tests them again 90 days later to make sure the engagement cannot be staged as a clean sample. Thorough review means picking three to five areas and going deep enough to find what a surface audit would miss. Staff interviews surface the gap between what the policy says and what people actually do on a Tuesday afternoon. Technical testing (configuration review, vulnerability scan, a targeted penetration test) produces findings the company has to fix, not findings they can file. The follow up 90 days out verifies the fix, not the paperwork. None of this is novel. The difference is execution.
How to find and pay for the honest auditor
Three moves if you are commissioning a security audit. Pay attention in the sales process. Whoever asks hard questions before the engagement is the same person who will ask them during it. Whoever accepts the scope on the first call without pushback is the one who will accept the findings you want them to accept. Look for a track record. An assessor who has never produced a major finding for a client has either been compromised or has been doing checkbox work the whole time. Pay for the depth. A surface engagement costs less, and a deep one finds the things that need to be found. The company that pays for the depth gets the audit that finds them.
The bottom line
A checkbox audit buys the report. An honest audit buys what the report contains. Pay for the depth, pick someone who has found real things in other clients, and treat the findings as the whole point of the exercise. Everything else is theatre.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
