Playbooks
Run an internal audit
Plan the year's programme, work through the checklist, record findings and their actions, prepare the management review.
Role: Compliance manager A certification body first asks for the year's internal audit programme (ISO 27001, clause 9.2). Screen details are in Audits.
Before you start: the statement of applicability is filled in (a control it excludes gets no point to check), and the Jira project for tickets is chosen if you want finding tickets.
1. Read the programme
Under "Programme of the year": number of audits, "Last audit completed" (at least one audit every 365 days is expected), coverage of "Clauses 4 to 10" and "Annex A (applicable controls)".
2. Plan
"New audit": "Auditor", "Planned date", "Status", then the scope (clauses, controls). The scope no longer changes once points have a result.
3. Work through it
- "Generate the list": one line per clause and per applicable control.
- For each point: "To check", "Compliant" or "Nonconforming", with a note.
- For a nonconforming point, "Write the finding": "Severity" ("Major", "Minor", "Observation", "Improvement"), what was found, the "Corrective actions" (at least one, with an owner and a due date for a nonconformity).
- "Create the Jira ticket" for an open nonconformity.
- When the fix is checked, "Close the finding".
4. Close the audit
All points are checked and each nonconforming point has its finding: "Close the audit". It then counts in coverage.
5. Prepare the management review
Under "Management review (clause 9.3)": agenda with the year's figures; export as text or CSV.
6. The proof
audits-internes.csv and constats.csv of the audit pack; every step is in the audit log.
What the app does not do
- It does not replace the internal auditor's competence and does not judge in their place.
- It does not do multi-year plans: the programme is one year's.
- It does not record the management review: the export is meeting material.
- An inactive or unknown account cannot be auditor or action owner.
Was this page helpful?