Audits

What the screen is for#

The "Audits" tab holds the "Internal audits": the year's audit programme, what it covers of the standard, each audit with its checklist and findings, and the preparation of the management review (ISO 27001, 9.2, 9.3 and 10.2). A certification body first asks for the year's internal audit programme.

Who can do what#

Step by step#

Read the programme#

Under "Programme of the year", you see the number of audits in the year, the "Last audit completed" (the auditor expects an audit at least every 365 days) and the coverage: "Clauses 4 to 10" and "Annex A (applicable controls)". Points "not audited yet" are flagged, along with those that no planned audit covers ("Trou du programme", Programme gap).

Plan an audit#

1. Click "New audit".
2. Choose the "Auditor", the "Planned date" and the "Status".
3. Under "Scope", choose clauses 4 to 10 and the Annex A controls to examine. A clause covers its sub-clauses. A control excluded by the Statement of Applicability will have no point to check.
4. Click "Save".

Once points on the checklist have a result, the scope can no longer change.

Run the audit#

1. Open the audit, then "Generate the list": one line per clause, and one per control that the statement says is applicable.
2. For each point, choose the result: "To check", "Compliant" or "Nonconforming". Add a short note.
3. For a non-compliant point, click "Write the finding".

Record a finding#

1. Click "New finding" (or "Write the finding").
2. Choose the "Severity": "Major", "Minor", "Observation" or "Improvement". Fill in the "Control or clause concerned" and "What was found".
3. Add the "Corrective actions". A non-conformity needs at least one, with an owner and a due date.
4. Click "Save the finding".
5. For an open non-conformity, click "Create the Jira ticket". You must first have chosen the tickets project in the "Plan d'action" tab. The ticket is tracked on the screen.
6. When the correction has been checked, click "Close the finding" and confirm: the corrective actions are then marked as verified.

Close the audit#

1. All points must be checked and each non-compliant point must have its finding.
2. Click "Close the audit" and confirm. Today's date becomes its end date, and the audit counts towards coverage. Its checklist no longer changes, but findings keep being followed.

Prepare the management review#

Under "Management review (clause 9.3)", you find the agenda: the "Inputs" and the "Decisions expected". Sections marked "Fed by the application" are pre-filled with the figures of the chosen year (audits, findings, late actions, risks, monitoring). The others are "To be brought by management". Export with "Export as text" or "Export as CSV".

External audit#

The "External audit" tab, "Auditor requests", tracks what the certification auditor asks for, who answers and with which proofs.

1. "Add a request": audit engagement (for example "ISO 27001 certification, stage 2"), the request, the owner who answers and the due date.
2. Filter: Open, Overdue, Provided, Accepted, Declined. The bar shows the share of requests that received an answer.
3. In the drawer, "Link evidence" picks a proof already filed in the app (50 at most per request); the request's owner or a person who runs the programme can attach or detach it. A provided or accepted request keeps at least one proof.
4. A request that is accepted or declined is locked: the auditor has decided, proofs no longer move. Only a person who runs the programme can reopen it.

Requests assigned to you appear in My work.

What the auditor will take from it#

An annual programme, a checklist marked point by point, findings with their corrective actions, and the management review's agenda with figures. The audits-internes.csv and constats.csv files of the audit pack reproduce them. Every step is in the audit log.

Known limits#

• There is no separate "auditor" role: they are the same people as for the Statement of Applicability.
• Inactive or unfound accounts cannot be auditor or owner of an action.
• A closed or cancelled audit can no longer be edited. A cancelled audit does not count towards coverage.
• The management review is not recorded in the app: the export is a meeting aid.
• The app does not produce a multi-year audit plan: the programme is that of one year.