After reading, you can plan an audit programme, run one audit from start to finish, and follow up what it finds.
Definition
ISO 19011 defines an audit as a systematic, independent and documented process for obtaining evidence and evaluating it objectively, to see how far criteria are fulfilled. Clause 9.2 of ISO/IEC 27001 requires internal audits at planned intervals.
The IIA's Global Internal Audit Standards govern the profession itself, which reaches further into governance and risk management.
Why it matters
It finds problems while they are still yours to fix, before a certification body, an authority or an incident does.
It also gives management a view that does not come from the people running the process.
How it works
Build the programme first: which areas, how often and why. Give priority to what carries the most risk or has recently changed, and choose auditors who will not be checking their own work.
For each audit, set the objectives, scope and criteria. Read the documents, then interview people, observe the work and sample the records.
Report the findings with their evidence and hold a closing meeting. Then follow the corrective actions to the end, and check that they worked.
A worked case
A company with 150 staff audits access management against ISO/IEC 27001, using an auditor from its finance team. The plan covers three systems over two days.
Of 25 departures sampled, 2 kept their access for more than a month. The finding sets out the criterion, the evidence and the effect. The IT manager commits to a corrective action by 30 April, and the auditor verifies it in June.
Good practices
- Tell the audited team the scope and dates in advance. An audit is not an ambush.
- Record the sample and how you chose it, so that someone else could repeat it.
- Report good practices as well as gaps. People cooperate more readily with an auditor who notices what works.
- Wait for a period of operation before checking a corrective action.
Common mistakes
- Letting people audit their own work, however small the team.
- Relying on interviews with no records behind them.
- Reporting opinions with no criterion attached, which turns the closing meeting into a debate.
- Closing an action because someone says it is done.
Questions
- How often must an internal audit happen?
- At planned intervals you set. ISO/IEC 27001 fixes no number, though a yearly programme covering the whole system within the certification cycle is common.
- Can a small company audit itself?
- Yes, if the auditor is objective and impartial. Staff from another department or an outside auditor both work.
- What is the difference between internal and external audit?
- The company commissions the first for itself. A customer, an authority or a certification body carries out the second.
- What is the three lines model?
- An IIA model in which management owns the risks, second-line roles support and oversee them, and internal audit gives independent assurance.
- How long should an audit report be?
- As short as clarity allows: scope, criteria, conclusion, findings with their evidence, and agreed actions.