This page sets out how content on TheAudit.org is researched, written, reviewed and corrected, and how we handle the commercial interests we hold in some of the categories we cover. It exists so you can judge how much weight to give what you read here.

How we source regulatory content

• Primary sources first. Requirements are taken from the published control catalogues and framework documents issued by the relevant authority — the National Cybersecurity Authority (NCA), the Saudi Central Bank (SAMA), SDAIA for PDPPL, and the equivalent bodies elsewhere in the Gulf — not from secondary summaries.
• We do not reproduce control text. Framework documents are the authority’s own material. We explain what a requirement means in practice and what an assessor looks for; we do not republish the catalogues.
• Version sensitivity. Control catalogues are revised. Where an article depends on a specific framework version, we say so, and we tell readers to verify against the current official publication before relying on it in an engagement.

Review and accuracy

• Articles covering regulatory requirements are reviewed by someone who works to that framework before publication.
• Methodology guidance reflects practice we have applied on real engagements, not theory assembled from other articles.
• Where we are uncertain, we say so rather than filling the gap with confident-sounding text.
• We do not publish AI-generated content as fact without a practitioner reviewing it for accuracy.

Commercial disclosure

Our team builds GRC and audit software: ControlVista, GRCVantage, BCMStack and AuditGRC. That creates an obvious interest in categories such as audit management software and business continuity software, and we handle it as follows:

• Ownership is disclosed in the article, not buried on this page. Any article discussing a product we build states that we build it, at the point where the product appears.
• Comparison pages name competitors fairly. We include independent vendors on merit and we state where our own product is not the right choice.
• We do not accept payment for coverage, placement or favourable treatment in comparisons.
• Guidance stands independently of our products. If an article’s advice only makes sense if you buy something from us, it is marketing, and it does not belong here.

Corrections

If you find an error, tell us. We correct factual errors promptly. For material corrections to regulatory or control content — the kind that could affect how someone scopes an engagement — we note what changed rather than editing silently.

What this site is not

Nothing here is legal advice, and it is not a substitute for your regulator’s published requirements or for professional judgement on your own engagement. Framework interpretation depends on your organisation’s classification, sector and scope. Verify against the current official publication and, where the stakes warrant it, take qualified advice.