ISMS Audit Expert

ISMS Audit Expert

Internal and external ISMS audit management for ISO 27001 compliance verification, security control assessment, and certification support.

Clarify First

Before planning or executing the audit, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Audit type — internal annual, Stage 1, Stage 2, surveillance, or recertification (sets the scope and checklist depth)
• Controls in scope — which Annex A controls / SoA coverage for this engagement (drives the schedule and testing)
• Risk ratings and prior findings — per-control risk and outstanding nonconformities (picks audit frequency and sample size)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the audit plan.

Audit Program Management

Risk-Based Audit Schedule

Workflow: Annual Audit Planning

1. Review prior audit results -- analyze previous findings, open items, and risk assessment outputs from the most recent cycle.
2. Identify high-risk controls -- flag controls involved in recent security incidents or with outstanding nonconformities.
3. Determine audit scope -- define ISMS boundaries, confirm Statement of Applicability (SoA) coverage for the certification cycle.
4. Assign auditors -- ensure independence from audited areas; verify auditor competency (ISO 27001 Lead Auditor certification preferred).
5. Create audit schedule -- allocate resources, assign dates, and distribute across the year by risk priority.
6. Obtain management approval for the finalized audit plan.
7. Validation checkpoint: Audit plan covers all 93 Annex A controls within the certification cycle; schedule approved by management; auditor independence confirmed.

Example: Annual Audit Plan Output