Audit Findings Register Template (ISO/IEC 27001 9.2 and 10.2)

One register for internal, certification body, customer and assessment findings: ID convention, grades, fields, status workflow, links to CAPA, reporting

ISMS und ISO/IEC 27001StandardISO/IEC 27001:2022 + Amd 1:2024 clauses 9.2, 9.3, 10.2 and A.5.35 (cited only)audit findings registerAktualisiert 01.11.2026

Im Editor öffnen.md herunterladen

Anleitung: Use it to track every ISMS finding, whatever its source, in one list. Fill the ID convention and grades first, then enter open findings from recent reports. The main pitfall is closing a finding when the action is done rather than when its effectiveness is verified.

Vorschau

Audit Findings Register: [Organization name]

One register for every finding raised against the information security management system (ISMS): internal audits, certification body audits, customer audits, regulator reviews and assessments such as penetration tests, gap assessments and independent reviews. It supports ISO/IEC 27001:2022 + Amd 1:2024 clauses 9.2 (internal audit), 9.3.2 (management review inputs on audit results and nonconformity trends) and 10.2 (nonconformity and corrective action), and control A.5.35 (independent review). Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-086
Version	[1.0]
Status	[Draft / Approved / Superseded]
Owner	[@isms-manager]
Approvers/reviewers	[@audit-programme-manager], [@ciso or steering committee chair]
Last updated	YYYY-MM-DD
Classification	[Confidential]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024 clauses 9.2, 9.3, 10.2; control A.5.35
Next scheduled review	YYYY-MM-DD
Register tool	[Spreadsheet / ticketing project / GRC tool]
Snapshot frequency	[Monthly, kept as records]

Approvals

Role	Name	Decision	Date
ISMS manager	[@isms-manager]	[Prepared]	YYYY-MM-DD
Top management sponsor	[@ceo or delegate]	[Approved]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	2027-01-20	[@isms-manager]	First approved register structure
1.1 (Example)	2027-04-05	[@isms-manager]	Added customer audit source and repeat-finding flag
[x.y]	YYYY-MM-DD	[@author]	[Change]

1. Purpose and scope

This register records each finding about the ISMS of [Organization name], its grade, owner, status and link to corrective or improvement action, from the moment it is raised until its effectiveness is verified. It covers the ISMS scope in DOC-ISMS-002 and all sources listed in section 2.

2. Sources and ID convention

IDs use the form AF-YYYY-NNN: year raised and a sequence number that never resets within the year. Keep the external reference (for example the certification body's finding number) in its own field.

Source code	Source	Typical origin
IA	Internal audit	Internal audit report DOC-ISMS-084
CB	Certification body audit	Stage 1, Stage 2, surveillance or recertification report
CUS	Customer audit or questionnaire follow-up	Customer audit report, contract review
REG	Regulator or supervisory review	Inspection letter
ASM	Assessment	Gap assessment DOC-ISMS-098, independent review DOC-ISMS-048, penetration test report
MR	Management review	Action raised in DOC-ISMS-085 that concerns a nonconformity

3. Grades

Grade	Code	Meaning in this register	Required link
Major nonconformity	MAJ	Required process or control absent or broken down, or a systemic failure	Corrective action record DOC-ISMS-087
Minor nonconformity	MIN	Isolated failure to meet a requirement	Corrective action record DOC-ISMS-087
Observation	OBS	Requirement met, weakness that could lead to a nonconformity	Owner decision recorded in the row
Opportunity for improvement	OFI	Requirement met, improvement suggested	Improvement register DOC-ISMS-088
Assessment finding	ASM-H / ASM-M / ASM-L	Technical finding rated High, Medium or Low by the assessor (for example a penetration test)	Vulnerability tracker DOC-ISMS-072 or risk register DOC-ISMS-016

Certification body findings follow the CB's own deadlines for corrections and corrective action plans (Example: 90 days as set by the CB). Enter the CB deadline in the due date field.

4. Fields

Field	Content
ID	AF-YYYY-NNN
Source and reference	Source code and the report or finding number
Date raised	YYYY-MM-DD
Grade	Section 3
Requirement	Clause, Annex A control as applied in the SoA, policy section or contract clause
Finding summary	One sentence, with extent
Owner	Process owner accountable for the response
Linked record	NC-YYYY-NNN, CI-YYYY-NNN, VUL-NNN or RISK-NNN
Due date	Plan due and completion due
Status	Section 5
Verified by and date	Who checked effectiveness, when
Repeat	Yes when a finding with the same requirement and cause was closed in the last 24 months (Example period)

5. Status workflow

Status	Entry rule
Open	Finding entered with source, grade and owner
Planned	Correction and corrective action plan (or owner decision for OBS, or evaluation link for OFI) recorded
InProgress	Plan accepted by the ISMS manager; for CB findings, plan accepted by the CB when it asks for this
AwaitingVerification	Owner provides evidence that actions are complete
Closed	Verifier (not the owner, for MAJ, MIN and ASM rows) confirms the action worked, with evidence; for a major CB finding, the CB's verification is recorded; OBS and OFI rows close when the decision is carried out or the CI entry exists
Reopened	Verification failed; reason recorded
Merged	Linked to the surviving finding ID; not counted again

6. Register

ID	Source and ref	Raised	Grade	Requirement	Finding summary	Owner	Linked record	Due	Status	Verified	Repeat
AF-2027-001 (Example)	IA, IA-2027-01	2027-03-17	MIN	9.1	Metric results not analysed or evaluated, 3 of 3 months	ISMS manager	NC-2027-004	2027-04-28 / 2027-05-21	Closed	Lead auditor, 2027-05-20	No
AF-2027-002 (Example)	IA, IA-2027-01	2027-03-17	MIN	A.5.18, DOC-ISMS-041	Contractor access removed late, 2 of 9 leavers	Head of Engineering Operations	NC-2027-005	2027-04-28 / 2027-05-21	Closed	Lead auditor, 2027-05-20	No
AF-2027-003 (Example)	IA, IA-2027-01	2027-03-17	OBS	7.5.3	Superseded copies of 2 policies on a shared drive	ISMS manager	Decision: delete and block copies	2027-04-28	Closed	ISMS manager, 2027-04-12	No
AF-2027-004 (Example)	IA, IA-2027-01	2027-03-17	OFI	6.2	4 of 6 objectives have no baseline	ISMS manager	CI-2027-007	2027-04-28	Closed	ISMS manager, 2027-03-29 (logged as CI-2027-007)	No
AF-2027-005 (Example)	CB, Stage 1 report, AOC-01	2027-04-16	OBS	4.1, 9.3.2	Climate change decision from 4.1 not recorded in the context record nor reviewed at the management review	ISMS manager	DOC-ISMS-003 v1.2; DOC-ISMS-091 tracker STG1-001	2027-04-30	Closed	ISMS manager, 2027-05-03	No
AF-2027-006 (Example)	CUS, customer audit 2027-07	2027-07-14	MIN	Contract security schedule clause 4	Customer data in support tool exports not deleted after 30 days	Head of Support	NC-2027-009	2027-08-13 / 2027-09-30	InProgress		No
AF-2027-007 (Example)	ASM, penetration test 2027-08	2027-08-22	ASM-H	A.8.8	Outdated web server component on the status page	Head of Engineering Operations	VUL-118	2027-09-05	AwaitingVerification		No
[AF-YYYY-NNN]	[Source, ref]	YYYY-MM-DD	[Grade]	[Requirement]	[Summary with extent]	[@owner]	[Record]	YYYY-MM-DD	[Status]	[@verifier, date]	[Yes / No]

7. Links to corrective action, risk and improvement

When a finding shows a new or changed risk, add or update the risk in the risk register (DOC-ISMS-016) and note the RISK ID in the linked record field. When the response changes the ISMS itself (a new process, a scope change), plan it through the ISMS change plan (DOC-ISMS-025). Certification body findings are also tracked in the certification findings action plan (DOC-ISMS-093) when the CB asks for a formal plan.

8. Reporting

Report at least these measures to each management review and to the steering committee (DOC-ISMS-007):

Measure	Definition	Example: Quillmere Analytics Ltd at 2027-09-01, 7 findings in 2027
Findings by grade	Count per grade raised in the period	MIN 3, OBS 2, OFI 1, ASM-H 1
Open findings	Status not Closed or Merged	2 (AF-2027-006, AF-2027-007)
Overdue	Open and past completion due date	0
Closed with verification	Closed rows with verifier and date	5 of 5 closed
Repeat findings	Repeat flag Yes	0
Findings by source	Count per source code	IA 4, CB 1, CUS 1, ASM 1

Check: 3 + 2 + 1 + 1 = 7 findings; 2 open + 5 closed = 7; 4 + 1 + 1 + 1 = 7 by source.

9. Size tiers

Aspect	Small: Quillmere Analytics Ltd (46 staff)	Medium: Quillmere Health Systems (320 staff)	Large or multi-site: Quillmere Group (2,400 staff, 6 sites)
Tool	Spreadsheet with monthly snapshot, or a project in the existing ticketing tool	Ticketing project with workflow states and due-date alerts	GRC tool shared with the ISO 9001 and ISO 22301 systems, site field mandatory
Volume (Example)	5 to 15 findings a year	30 to 60 findings a year, including hospital customer audits	Several hundred across sites and systems
Verification	External contract auditor or ISMS manager (not for own findings)	Internal audit pool	Site auditors and group security office
Extra fields	None	Customer name for customer audits, regulator reference	Site, management system (ISMS, QMS, BCMS), country
Reporting	Monthly to the steering committee	Monthly to the security team, quarterly to the steering committee	Monthly per site, quarterly consolidated to the CISO and group management review

10. Records and evidence

Record	Proves	Owner	Location	Retention (Example)
Register and monthly snapshots	Findings tracked from raising to closure	ISMS manager	Register tool, snapshots in the ISMS folder	Current certification cycle plus 3 years
Linked corrective action records	Clause 10.2 actions and effectiveness	Process owners	DOC-ISMS-087 records	Same
Source reports	Origin and evidence of each finding	Audit programme manager	Audit folder	Same
Management review summaries	Trends reported to top management	ISMS manager	DOC-ISMS-085	Same

11. References

Reference	Edition and status (as of November 2026)	Use
ISO/IEC 27001:2022 + Amd 1:2024	Current; Amd 1 published 2024-02-23	Clauses 9.2, 9.3, 10.2; control A.5.35
ISO 19011:2026	Current, published 2026-05-27	Audit follow-up
ISO/IEC 17021-1:2015	Current	Certification body findings and their handling
`isms/isms-internal-audit-report`	DOC-ISMS-084	Source of internal findings
`compliance/capa-nonconformity`	DOC-ISMS-087	Corrective action records
`isms/continual-improvement-register`	DOC-ISMS-088	OFIs
`isms/certification-findings-action-plan`	DOC-ISMS-093	Certification body findings
`isms/vulnerability-remediation-tracker`	DOC-ISMS-072	Technical assessment findings

Official text (purchase or licensed access): ISO/IEC 27001 https://www.iso.org/standard/82875.html and Amd 1 https://www.iso.org/standard/88435.html; ISO 19011 https://www.iso.org/standard/88984.html; ISO/IEC 17021-1 https://www.iso.org/standard/61651.html.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 9.2, 9.3 and 10.2 and control A.5.35. Fields, grades, workflow and examples are original wording written for this template; no ISO or IEC text, tables or definitions are reproduced. Use the official standard, which is copyrighted and sold by ISO, IEC and national standards bodies. Check the current edition before use. Template licence: MIT.