An audit is a systematic, independent, and documented process for obtaining evidence and evaluating it objectively to determine the extent to which a set of criteria is fulfilled. In the context of ISO 27001, an audit is used to check if an organisation’s Information Security Management System (ISMS) meets the standard’s requirements.
Types & Examples
- Internal Audit: An audit conducted by the organisation itself. This is a mandatory and essential dress rehearsal to identify any gaps or weaknesses in the ISMS before an external audit.
- External Audit: An audit conducted by an independent, accredited third-party certification body. This type of audit is required for an organisation to achieve and maintain its ISO 27001 certification.
- Surveillance Audit: A periodic external audit (typically annual) after initial certification to ensure the organisation is continuing to comply with the standard.
Context
The ISO 27001 standard mandates that organisations conduct internal audits at planned intervals (ISO 27001 Clause 9.2 Internal Audit) to ensure their ISMS is effectively implemented and maintained. Audits are a core component of the check phase in the Plan-Do-Check-Act (PDCA) cycle, driving continual improvement.
