How to do an ISO 27001 Internal Audit + Template

Time needed: 1 hour and 30 minutes

How to conduct an ISO 27001 Internal Audit

1. Create your ISO 27001 Audit Plan

   The audit plan document allows you to plan both the internal and external audits for the year and to record when those audits took place. 
   
   You will complete the audit plan for the year ahead. Remembering that audit is based on risk the following are considerations when planning audits:
   
   Plan your external audits first. These represent anchor points and give you a goal and target by which your internal audits should have completed. 
   
   The entire ISMS and the Annex A / ISO 27002 controls require auditing at least once in a 12-month period.
   
   When considering if an area requires auditing more than once consider if the control represents a high-risk area or a significant incident or failing has occurred with the control in the last 12 months.
   
   Note: Remember to audit both the ISMS and the ANNEX A controls.
   
   

2. Keep the audit plan up to date

   The audit plan is updated based on changes and scheduling requirements. The following are usual scenarios when the audit plan will require updating:
   
   Staff availability changes
   Your audit plan slips
   You have a significant incident
   
   When the audit plan changes it should be presented at the next Management Review Team Meeting and recorded in the minutes of the meeting.
   
   Note: Remember to update your document version control 

3. Identify the control owners

   The conduct and internal audit we need to know who we are going to audit. Identify and document the information security control owners and contact details.
   
   The RASCI document is used to record who is accountable and who is responsible for the controls. Using this document, you will have recorded the people to speak to.
   
   

4. Decide on your audit approach

   Audit is based on ‘If it is not written down it does not exist’. Your audit will look for evidence of documents, files, records. You have 3 main options in conducting an audit and you can choose one or a combination of the following:
   
   Interview: Speaking to people and seeking answers to questions on controls. Be sure to record the date, time, location and who as well as the notes from the interview. It is best practice though not essential to send the record of the interview to the interviewee stating that if you have misunderstood or misrepresented for them to send you back the changes. 
   
   Observation of process and activity: Like an interview you will sit with the person and observe either the systems they use or the operation of the process as they perform it. Follow the same guidelines as for interview. 
   
   Review of documents and records: Speaking to control owners you will ask them to send you links to or copies of the documentation and records that make up the control. It can include screenshots. You are looking for the evidence of the operation of the process and control. 

5. Contact the Control Owners

   Make contact with the person or persons that you are going to audit. Introduce yourself and explain the context of what you are going to do, what you are going to cover in the audit and what the outcome will be. Explain to them your approach to the audit based on the 3 options discussed when deciding your audit approach. Ask them for the best times and dates for holding a 1-hour meeting to conduct the audit and be flexible to their schedule. You want the person onside and comfortable.

6. Arrange the Audit Meeting

   Your audit meeting can take from 10 minutes up to 1 hour depending on the maturity of the process and the availability of the evidence. Schedule your first meeting for 1 hour. 
   
   Create and send an agenda that covers:
   The time, location, and attendees 
   The details of the control objectives you will cover.
   The list of documents or types of documents and records you would like access to .
   
   Send the agenda and the meeting request in good time and be prepared to reschedule based on people’s availability.
   
   Save a copy of the agenda in the audit folder for your records.
   
   For a face-to-face meeting ensure that the meeting takes place in location with a screen on which the person can display any relevant documents.
   
   For a web-based meeting ensure your environment is set up for a professional level meeting and your technology is properly configured. If sharing a desktop be sure that no confidential documents are open, that notifications are disabled, that chat is disabled. 

7. Conduct your first meeting

   Introduce yourself and explain the context of what you are doing, the agenda and what you are hoping to achieve. Explain the audit approach that you have decide to take.  Explain that this is not a test, that not knowing an answer is perfectly acceptable and that a follow up meeting can be arranged for any gaps or documents can be shared after the meeting. 

8. Perform the audit

   For each control that you are auditing:
   Read the control objective. 
   Clarify what the control objective is hoping to achieve.
   Seek evidence that the control and control objective is being met and record your findings.
   
   

9. After the Audit Meeting

   If there are items that were not able to be covered and require follow up repeat the above process until you are satisfied you have covered all control objectives and reviewed all available evidence.

10. Create the internal audit report

    Record your findings in the audit report. Include an audit report summary and your audit working papers.

11. Report your audit findings to those audited

    Either in person or digitally present your audit findings to the person(s) audited.  Seek agreement that it represents what was discussed and the reality as they see it or clarifications they would wish to make. It may be that you have misunderstood something or that further evidence is available but was not provided on the day. 
    Be clear that the findings are not a reflection on any individual or their role and are not a comment on the operation in either a positive or negative way. Explain the findings are objective based on evidence provided. Where there is a request to provide additional supporting evidence consider setting a time limit.

12. Report your audit findings to the Management Review Team

    Present the audit report and findings to the management review team and interested parties.

13. Update the Incident and Corrective Action Log

    Update the Incident and Corrective Actions Log with nonconformities and the corrective actions. 
    
    

14. Update the Risk Register

    Consider if a new risk is required on the risk register and to be managed as part of the risk management process.
     

15. Update the Audit Schedule

    Update the audit schedule to show that the audit that was conduct. 
    Update the forward schedule for future audits as required based on the outcome of this audit. If Non-Conformities were observed, consider scheduling a reaudit in 3 months time. 
    Update all document version control information.