Internal Audit and Management Review Procedure

Purpose

This Procedure sets out two linked activities of the management system: the internal audit that checks whether the system works as planned, and the management review in which the Management Board judges how well it performs.

Scope

It covers the whole information security management system, all its documents and controls, and all the locations and teams within the ISMS scope.

Roles

• Management Board: approves the audit programme and holds the management review.
• ISMS Manager: owns this Procedure, prepares the review, and tracks corrective actions.
• Internal Auditor: plans and carries out audits.
• Control owners: supply information and fix Findings.

Part A Internal audit

Programme and independence

1. The Management Board approves an annual audit programme that covers every part of the system at least once, with more attention for areas that carry more risk or that had problems before.
2. Auditors are independent of what they audit. The Internal Auditor does not audit controls they operate. For those, a second auditor from another team or an external consultant carries out the audit.

Audit

1. The Internal Auditor plans each audit with its objective, scope, criteria, and dates, and tells the control owners.
2. During fieldwork, the auditor interviews staff, observes work, and examines records. The auditor notes the evidence for every conclusion.
3. The auditor writes a report and discusses it with the control owners before it is final.

Findings and corrective action

1. Each Finding gets a severity and an owner.
2. The owner finds the root cause, proposes a corrective action, and agrees a due date.
3. The ISMS Manager tracks every action as a Task. When an action is done, the Internal Auditor checks that it worked.

Part B Management review

Preparation and meeting

1. The Management Board holds the review at least once a year.
2. The ISMS Manager prepares the inputs required by ISO/IEC 27001:2022 clause 9.3.2: the status of earlier actions, changes in internal and external issues, and feedback on performance. The feedback covers nonconformities, monitoring results, audit results, and the achievement of objectives. The inputs also hold feedback from interested parties, the results of risk assessment and the state of the treatment plan, and opportunities for improvement.

Outputs

1. The review decides on the outputs of clause 9.3.3: opportunities for continual improvement and any need for changes to the system.
2. Each decision gets an owner and a due date, and becomes a Task.
3. The ISMS Manager writes the minutes and keeps them. The next review starts with the status of these decisions.

Records

• The audit programme, plans, reports, and Findings.
• The corrective actions and the checks on their effect.
• The inputs and the minutes of every management review.

Related documents

• Information Security Policy
• Risk Management Policy
• ISMS scope

Review

The ISMS Manager reviews this Procedure at least once a year and after a significant change.