IT audit in Dubai: three different things get sold under one name, and buying the wrong one is expensive.

It is a fair question and you should ask it of anyone. Our position is that for a gap assessment, a technical test or an evidence pack supporting a customer or bank review, there is no structural conflict, because the findings are verifiable by whoever asked for them and inflating a finding list to sell remediation would be immediately visible. Where a genuine independence requirement exists, most commonly a formal certification audit or an internal audit function reporting to a board, that work must be performed by a party who does not also remediate, and we will say so and work alongside an independent assessor rather than pretending otherwise. What we will not do is perform the independent assurance and the remediation on the same engagement where independence is the point of the exercise.

It varies by more than an order of magnitude, which is why we scope before quoting rather than publishing a rate. A focused Microsoft 365 tenant review is a small piece of work measured in days. A full framework gap assessment for a regulated multi-site business is weeks. A penetration test is priced per scope, and an external network test, an internal test, a web application test and a social engineering exercise are four separate pieces of work rather than one. The drivers are the framework, your size and site count, how much existing certification transfers, and whether remediation is included. The applicability review that establishes all of this is a small fixed fee and it frequently reduces the total.

Predictable rather than catastrophic, in our experience. The findings cluster in the same places almost every time: incomplete MFA coverage, dormant accounts belonging to people who left, standing administrative privilege nobody reviews, backups never restore-tested, no documented incident response plan, audit log retention at default, and no evidence of access recertification. None of those are unusual and most are cheap to close. What genuinely varies is documentation, because organisations that have never been audited generally have controls operating in people heads rather than written down, and writing them down is a large part of the first engagement. Going in expecting findings is healthier than hoping for none.

Long enough to matter and shorter than people assume. Most requesters treat a report older than twelve months as stale, and many banks and enterprise customers want something within six. Technical test reports age faster because your environment changes: a penetration test from eight months ago says nothing about the service you deployed last month. This is the argument for continuous evidence rather than an annual exercise. Organisations running the assessment as a yearly project spend the same money and hold a document that is out of date for most of the year, whereas maintaining the pack keeps it current for whenever the request lands.

Yes, and it is a common starting point. The first step is reading the actual findings rather than the summary, because the wording determines what closure requires, and organisations frequently over-interpret or under-interpret it. Then we sequence remediation by what the requester will re-check first rather than by technical severity, which are not always the same thing. Where a finding cannot be closed in the time available, a documented risk acceptance with a dated remediation plan is usually acceptable and silence is not. We would also look at why it was missed, because a failed assessment is often a symptom of nobody owning the compliance calendar rather than a specific control failure.

Often overkill, and we will say so before you spend six to twelve months on it. ISO 27001 is worth pursuing when a customer or tender specifically requires the certificate, when you are selling into markets where it is table stakes, or when you genuinely want the management system discipline. It is not worth pursuing because it sounds like the responsible thing to do, or because a consultancy suggested it in response to a bank asking a security questionnaire. For most UAE mid-market businesses, implementing the controls properly and being able to evidence them answers every question they actually face, at a fraction of the cost. If certification later becomes a commercial requirement, that groundwork transfers substantially.

A scan is automated and identifies known weaknesses across a broad surface. A penetration test is performed by a person who chains findings together, tries things a scanner will not, and establishes what an attacker could actually achieve rather than what is theoretically present. Scans are cheap and should run frequently, often quarterly, and are what most regulatory cadences mean by vulnerability assessment. Penetration tests are more expensive, run annually for most organisations, and produce a materially different quality of insight. Being sold a scan presented as a penetration test is common enough to be worth checking: ask who performed it, how long it took, and whether the report contains anything a tool could not have produced.

Less time than people fear, from the right people. You need somebody senior enough to approve policy and accept risk, because a finding that requires a decision will otherwise sit open indefinitely waiting for a committee. You need whoever holds administrative access to the systems in scope, for evidence gathering. You need somebody who understands the business processes well enough to tell us when a proposed control is unworkable in practice. For a typical assessment that is perhaps six to eight hours of your people time spread across a fortnight. Remediation needs more, and where you genuinely have nobody to own it, that gap is worth solving before the audit rather than after.

Yes, and for most clients it is the more valuable half. Reaching a compliant state is a project with an end; staying there is a recurring calendar of vulnerability scans, penetration tests, access reviews, restore tests, incident exercises, supplier assessments and policy reviews, each producing evidence that must be current on the day it is requested. We run that calendar, produce the evidence, chase the items needing your sign-off, and keep the pack ready. Organisations that hand this back to an already busy internal team are the ones we later find with eighteen months of drift and a reassessment approaching.

A gap assessment is almost entirely non-intrusive: it is evidence gathering, configuration review and interviews, and your users will not notice it happening. Vulnerability scanning is run against agreed targets in agreed windows and is low impact, though we schedule it outside peak periods for warehouses and retail because scanning does consume some capacity. Penetration testing carries genuine, if small, risk of disruption because the point is to try things, so it runs against an agreed scope with a defined stop condition, a named contact reachable throughout, and for anything genuinely fragile we test in a staging environment rather than production. Social engineering exercises need particular care and explicit written authorisation from someone senior enough to authorise them, because the failure mode there is reputational rather than technical.

We will tell you at the first call rather than taking the work and missing it. Where the deadline genuinely cannot be met in full, the workable answer is almost always a documented position: what you have implemented and can evidence today, what remains open, and a dated plan with named owners for the rest. Banks, enterprise customers and most regulators accept that considerably better than an overstated claim that collapses under one follow-up question. What damages you is presenting partial compliance as complete, because the credibility loss extends beyond the specific finding. We would rather help you give a precise, honest answer on time than a comprehensive one late.