ISMS Internal Audit Report Template (ISO/IEC 27001 clause 9.2)
Report for one ISMS audit: scope, criteria, team and independence, sampling, findings with evidence and clause references, conclusions, distribution, follow-up
使い方: Use it after each internal ISMS audit to report results to management. Fill scope, criteria and the audit team's independence first, then each finding with requirement, evidence and extent. The main pitfall is a finding that states an opinion and cannot be re-checked.
プレビュー
ISMS Internal Audit Report: [Organization name] [IA-YYYY-NN]
Report format for one internal audit of an information security management system (ISMS) under ISO/IEC 27001:2022 + Amd 1:2024, clause 9.2 (internal audit). An audit only counts if the managers who can act on it see the outcome and a record of it survives for the next auditor. This report records the scope and criteria, the audit team and its independence, the sampling, the findings with evidence and clause references, the conclusions, the distribution and the follow-up. Method follows the guidance of ISO 19011:2026 and ISO/IEC 27007:2020. Replace every
[bracketed]value and every row marked Example.
Document control
| Field | Value |
|---|---|
| Document ID | DOC-ISMS-084 |
| Audit reference | [IA-YYYY-NN] (Example: IA-2027-01) |
| Version | [1.0] |
| Status | [Draft for factual review / Issued / Superseded] |
| Owner | [@audit-programme-manager] |
| Approvers/reviewers | [@lead-auditor] (author), [@isms-manager] (factual review), [@ceo or steering committee chair] (receives) |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 clause 9.2; guidance ISO 19011:2026 and ISO/IEC 27007:2020 |
| Audit dates | YYYY-MM-DD to YYYY-MM-DD |
| Audit programme reference | DOC-ISMS-082 [programme period], audit [A-NN] |
| Checklist reference | DOC-ISMS-083, completed copy [file name] |
| Next scheduled review | Not applicable for an issued report; the master format is reviewed with DOC-ISMS-082 on YYYY-MM-DD |
Approvals
| Role | Name | Decision | Date |
|---|---|---|---|
| Lead auditor | [@lead-auditor] | [Prepared and signed] | YYYY-MM-DD |
| ISMS manager | [@isms-manager] | [Facts confirmed / Facts disputed, see section 9.4] | YYYY-MM-DD |
| Audit programme manager | [@audit-programme-manager] | [Issued] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 0.9 (Example) | 2027-03-25 | [@lead-auditor] | Draft for factual review |
| 1.0 (Example) | 2027-03-29 | [@lead-auditor] | Issued; AF-2027-003 extent corrected from 3 to 2 documents after factual review |
| [x.y] | YYYY-MM-DD | [@author] | [Change] |
Contents
- Executive summary
- Audit objectives, scope and criteria
- Audit team, independence and impartiality
- Audit plan and method
- Sampling and evidence reviewed
- Summary of findings
- Detailed findings
- Positive practices
- Conclusions
- Follow-up of previous findings
- Corrective action and follow-up
- Distribution and confidentiality
- Size tiers
- Records and evidence
- References
1. Executive summary
[Two or three short paragraphs: what was audited, the overall conclusion, the most important findings, any decision needed from top management.]
Example (Quillmere Analytics Ltd, IA-2027-01): The internal audit on 15 to 17 March 2027 covered clauses 4 to 10 of ISO/IEC 27001:2022 + Amd 1:2024 and 30 Annex A controls from the 2027 rotation set. The audit found 0 major nonconformities, 2 minor nonconformities, 1 observation and 1 opportunity for improvement.
The ISMS conforms to the standard and to the organization's own requirements for most of the audited scope and is effectively implemented in risk management, incident handling, supplier management and backup. Two weaknesses need corrective action before the Stage 2 audit planned for May 2027 (2027-05-10 to 12): measurement results are collected but not analysed or evaluated (clause 9.1), and access for departing contractors is removed late because contractor departures do not reach IT through the HR leaver process (control A.5.18 as implemented by the access control policy).
Decision needed: top management to confirm the owner for contractor offboarding, which today sits between Finance (contracts) and Engineering Operations (accounts).
2. Audit objectives, scope and criteria
| Item | Value |
|---|---|
| Objectives | [List] (Example: confirm conformity of clauses 4 to 10 before Stage 2; test the operation of the 2027 Annex A rotation set; check readiness evidence for the certification audit) |
| Clauses in scope | [4 to 10] |
| Annex A controls in scope | [List or set name] (Example: 30 controls in the 2027 rotation set, trails TR-01, TR-03, TR-04, TR-05, TR-10, TR-11; the 7 controls re-sampled every year, A.5.15 to A.5.18, A.8.8, A.8.13 and A.8.24, are part of this set) |
| Sites, services, teams | [List] (Example: head office, remote staff, production on the public cloud primary and DR regions, customer support) |
| Record period | YYYY-MM-DD to YYYY-MM-DD (Example: 2026-09-01 to 2027-02-28) |
| Audit criteria | ISO/IEC 27001:2022 + Amd 1:2024; Statement of Applicability DOC-ISMS-011 version [x]; information security policy DOC-ISMS-001; topic policies in DOC-ISMS-005; legal, regulatory and contractual requirements in DOC-ISMS-014 |
| Out of scope for this audit | [List with reason] (Example: A.7 controls at the office, scheduled for the 2029 walk-through) |
| Changes to scope during the audit | [None / description and reason] |
3. Audit team, independence and impartiality
| Role | Name or role | Competence evidence | Areas audited | Areas excluded for independence |
|---|---|---|---|---|
| Lead auditor | [@lead-auditor] | [Training, prior audits] | [Clauses, trails] | [Areas] |
| Auditor | [@auditor] | [Training, prior audits] | [Clauses, trails] | [Areas] |
| Lead auditor (Example) | External contract auditor | ISO/IEC 27001 lead auditor training, competence record in DOC-ISMS-026 | Clauses 4 to 10, TR-01, TR-04, TR-05, TR-11 | None |
| Auditor (Example) | Finance Manager (trained internal auditor) | Internal auditor course 2026, one shadow audit | TR-03, TR-10, clause 7 | TR-04 supplier trail and A.5.19 to A.5.23, because Finance runs procurement |
| Not on team (Example) | Head of Engineering Operations (0.5 FTE ISMS manager) | All: manages the ISMS and the audit programme; clause 9.2 was audited by the lead auditor |
Confirmations:
- No auditor audited a process they operate, designed or manage.
- Clause 9.2 was audited by someone other than the audit programme manager.
- Audit evidence was stored in the agreed restricted location.
- Any AI-based tool used to summarise evidence was agreed in the audit plan and its output checked against source records. [Not used / Tool and use]
4. Audit plan and method
| Item | Value |
|---|---|
| Method | [On site / Remote / Blended] (Example: blended, day 1 on site at the office, days 2 and 3 remote with screen sharing) |
| Remote platform and rules | [Platform category, recording rules] (Example: company video meeting tool, no recording, evidence exported by the auditee and uploaded to the audit folder) |
| Opening meeting | YYYY-MM-DD, attendees by role |
| Closing meeting | YYYY-MM-DD, attendees by role |
| Interviews | [Number and roles] (Example: 11 interviews: CEO, ISMS manager, 2 risk owners, 3 control owners, HR lead, 3 staff from sales, support and engineering) |
| Limitations | [None / description] (Example: cloud provider assurance report for the DR region not available during the audit, received 2027-03-19 and reviewed before the report was issued) |
5. Sampling and evidence reviewed
| Population | Size | Sample | Method | Result |
|---|---|---|---|---|
| [Population] | [n] | [n] | [Whole / Judgement / Random / Data analytics] | [Exceptions] |
| Leavers, record period (Example) | 9 (7 employees, 2 contractors) | 9 | Whole population | 2 exceptions (AF-2027-002) |
| Joiners, record period (Example) | 11 | 5 | Judgement: 3 engineers with production access, 2 random | 0 exceptions |
| Production changes (Example) | 214 | 10 | Random 8 by change ID plus 2 emergency changes | 0 exceptions |
| Critical vulnerabilities (Example) | 17 | 5 | Judgement: oldest 5 | 0 exceptions outside the policy deadline |
| Suppliers (Example) | 31 | 5 | Judgement: 3 critical plus 2 random | 0 exceptions |
| Endpoints (Example) | 52 | 5 | Random from the MDM inventory | 0 exceptions |
| Risks in the register (Example) | 64 | 5 | Judgement: 3 High, 2 Medium | Scores reproduced correctly |
| Controlled documents (Example) | 38 | 5 | Random from DOC-ISMS-028 | 2 superseded copies found outside the repository (AF-2027-003) |
Documents reviewed: [list with IDs and versions]. Example: DOC-ISMS-001 v2.0, DOC-ISMS-002 v1.2, DOC-ISMS-010 v2.0, DOC-ISMS-011 v1.1, DOC-ISMS-013 v1.3, DOC-ISMS-016 (export 2027-03-10), DOC-ISMS-024 v1.0, DOC-ISMS-041 v1.0, DOC-ISMS-080 v1.0.
6. Summary of findings
| Grade | Count | Finding IDs |
|---|---|---|
| Major nonconformity (MAJ) | [n] (Example: 0) | [IDs] |
| Minor nonconformity (MIN) | [n] (Example: 2) | [IDs] (Example: AF-2027-001, AF-2027-002) |
| Observation (OBS) | [n] (Example: 1) | [IDs] (Example: AF-2027-003) |
| Opportunity for improvement (OFI) | [n] (Example: 1) | [IDs] (Example: AF-2027-004) |
| Total | [n] (Example: 4) |
Results by clause (Example, from checklist section 17):
| Clause | Questions | C | MAJ | MIN | OBS | OFI (with C) |
|---|---|---|---|---|---|---|
| 4 Context | 4 | 4 | 0 | 0 | 0 | 0 |
| 5 Leadership | 3 | 3 | 0 | 0 | 0 | 0 |
| 6 Planning | 5 | 5 | 0 | 0 | 0 | 1 |
| 7 Support | 7 | 6 | 0 | 0 | 1 | 0 |
| 8 Operation | 3 | 3 | 0 | 0 | 0 | 0 |
| 9 Performance evaluation | 6 | 5 | 0 | 1 | 0 | 0 |
| 10 Improvement | 2 | 2 | 0 | 0 | 0 | 0 |
| Total | 30 | 28 | 0 | 1 | 1 | 1 |
| Annex A controls sampled | 30 | 29 | 0 | 1 | 0 | 0 |
7. Detailed findings
7.1 Finding format
| Field | Content |
|---|---|
| Finding ID | AF-YYYY-NNN (from DOC-ISMS-086) |
| Grade | MAJ / MIN / OBS / OFI |
| Requirement | Clause, Annex A control as applied in the SoA, or policy section |
| Evidence | What was seen, with record IDs and dates |
| Extent | Exceptions out of sample, and sample out of population |
| Statement | What is missing or not met, in one sentence |
| Risk or effect | Why it matters, with risk register ID where one exists |
| Owner | Process owner who will respond |
| Response due | Date for the correction and corrective action plan |
7.2 Findings
AF-2027-001 (Example): Minor nonconformity, clause 9.1
| Field | Content |
|---|---|
| Requirement | Clause 9.1: metric results have to be looked at on a set schedule and used to judge how well the ISMS is working; measurement programme DOC-ISMS-080 requires a monthly review of metric results by the ISMS manager |
| Evidence | Metric extracts for December 2026, January 2027 and February 2027 exist in the ISMS folder. No record of analysis, evaluation or decisions for any of the three months. Interview with the ISMS manager confirmed the reviews did not take place because of release workload |
| Extent | 3 of 3 monthly reviews in the sampled period missing |
| Statement | Measurement results are collected but are not analysed or evaluated as the organization planned |
| Risk or effect | Management review in April 2027 would lack evaluated performance information; trends such as rising patch times would go unnoticed |
| Owner | ISMS manager |
| Response due | 2027-04-28 |
AF-2027-002 (Example): Minor nonconformity, control A.5.18 as implemented by the access control policy
| Field | Content |
|---|---|
| Requirement | SoA DOC-ISMS-011 marks A.5.18 Implemented; access control policy DOC-ISMS-041 requires all access of a leaver to be removed within 1 business day of the last working day |
| Evidence | HR leaver list and identity provider audit log export of 2027-03-16. Seven employee leavers removed on the last working day. Two contractor leavers removed 4 and 6 business days late; the requests came from the engineering manager, not from HR |
| Extent | 2 of 9 leavers (both contractors, 2 of 2 contractor leavers) |
| Statement | Access of departing contractors is not removed within the time the policy requires |
| Risk or effect | Former contractors kept access to the code repository and the support tool after leaving; linked risk R-018 (unauthorised access by former personnel) |
| Owner | Head of Engineering Operations, with Finance for contractor contracts |
| Response due | 2027-04-28 |
AF-2027-003 (Example): Observation, clause 7.5.3
| Field | Content |
|---|---|
| Requirement | Clause 7.5.3: ISMS documents are kept under control, so old versions do not stay in circulation and records are kept and disposed of on purpose; the document control rules recorded with the documented information register DOC-ISMS-028 require superseded versions to be withdrawn from use |
| Evidence | The document repository holds the current versions with correct approval records. A shared team drive holds copies of two superseded topic policies (remote working v0.9, acceptable use v1.0), last opened in January 2027 |
| Extent | 2 of 38 controlled documents have uncontrolled superseded copies |
| Statement | Superseded copies outside the repository could be used by mistake |
| Owner | ISMS manager |
| Response due | Decision by 2027-04-28 |
AF-2027-004 (Example): Opportunity for improvement, clause 6.2
| Field | Content |
|---|---|
| Requirement | Clause 6.2 is met: objectives are set, measurable and monitored |
| Observation | Four of the six objectives in DOC-ISMS-024 have targets but no baseline value, so progress is hard to show at management review |
| Suggestion | Record a baseline for each objective when it is set |
| Owner | ISMS manager, logged as CI-2027-007 in DOC-ISMS-088 |
8. Positive practices
| Area | Practice | Evidence |
|---|---|---|
| [Area] | [Practice] | [Evidence] |
| Backup (Example) | Quarterly restore tests completed on time, with restore time measured against the target | DOC-ISMS-071, four quarters |
| Risk management (Example) | Every sampled risk had an owner, a reproducible score and a treatment decision traceable to the SoA | DOC-ISMS-016, 5 of 5 risks |
| Incident handling (Example) | Both incidents in the period had a post-incident review with actions closed | DOC-ISMS-021, DOC-ISMS-022 |
9. Conclusions
9.1 Conformity
[Statement on conformity with ISO/IEC 27001:2022 + Amd 1:2024 and with the organization's own requirements, for the audited scope.]
Example: The ISMS conforms to the requirements of clauses 4 to 10 for the audited scope, except for clause 9.1 (AF-2027-001). The sampled Annex A controls operate as described in the SoA, except A.5.18 for contractor leavers (AF-2027-002).
9.2 Effectiveness
[Statement on whether the ISMS is effectively implemented and maintained, and whether it achieves its intended results.]
Example: The ISMS is effectively implemented and maintained. Risk management, incident handling, supplier management and backup produce reliable records. Performance evaluation is the weakest process and needs correction so that the first management review before Stage 2 is based on evaluated data.
9.3 Objectives and limits
| Objective | Met? | Comment |
|---|---|---|
| [Objective from section 2] | [Yes / Partly / No] | [Comment] |
| Conformity of clauses 4 to 10 before Stage 2 (Example) | Yes | Two minor findings to close before Stage 2 |
| Operation of the 2027 Annex A rotation set (Example) | Yes | 30 of 30 controls tested |
| Readiness evidence for the certification audit (Example) | Partly | Management review not yet held; planned for April 2027 |
Limits on the evidence: [None / description]. Example: judgement-based samples; the conclusions apply to the sampled period and items and do not give statistical assurance over the whole population.
9.4 Disputed facts
[None / finding ID, the auditee's position and the lead auditor's response.]
10. Follow-up of previous findings
| Finding ID | Source | Grade | Status at this audit | Effective? | Evidence |
|---|---|---|---|---|---|
| [AF-YYYY-NNN] | [Internal audit / CB / Customer / Assessment] | [Grade] | [Open / Closed] | [Yes / No, reopened / Not yet verifiable] | [Record] |
| AF-2026-006 (Example) | Gap assessment DOC-ISMS-098 | MIN | Closed 2026-12-10 | Yes: 3 of 3 sampled supplier contracts now include security clauses | Contracts SUP-004, SUP-011, SUP-019 |
| AF-2026-009 (Example) | Internal audit IA-2026-02 | OBS | Open | Not yet verifiable | Asset inventory review planned April 2027 |
11. Corrective action and follow-up
| Finding ID | Response | Record | Owner | Plan due | Verification method | Verification due |
|---|---|---|---|---|---|---|
| [AF-YYYY-NNN] | [Correction and corrective action / Decision / Evaluation] | [NC-YYYY-NNN / CI-YYYY-NNN] | [@owner] | YYYY-MM-DD | [Method] | YYYY-MM-DD |
| AF-2027-001 (Example) | Corrective action | NC-2027-004 | ISMS manager | 2027-04-28 | Review the April and May 2027 metric reviews | 2027-05-21 |
| AF-2027-002 (Example) | Corrective action | NC-2027-005 | Head of Engineering Operations | 2027-04-28 | Re-sample all contractor and employee leavers since the fix | 2027-05-21 |
| AF-2027-003 (Example) | Owner decision | DOC-ISMS-086 entry | ISMS manager | 2027-04-28 | Check shared drives for superseded copies | Next audit |
| AF-2027-004 (Example) | Evaluation | CI-2027-007 | ISMS manager | 2027-04-28 | Improvement register status | Next management review |
12. Distribution and confidentiality
| Recipient | Content | Format | Date sent |
|---|---|---|---|
| [Top management / steering committee] | [Full report / summary] | [Format] | YYYY-MM-DD |
| CEO and steering committee (Example) | Full report | Repository link, restricted group | 2027-03-29 |
| Process owners with findings (Example) | Sections 7 and 11 for their findings | Repository link | 2027-03-29 |
| Certification body (Example) | Full report on request during Stage 1 and Stage 2 | Shared during the audit, not e-mailed | On request |
Classification: [Confidential]. Do not share the report outside the distribution list without approval from the ISMS manager. Customers asking for audit evidence receive a summary or the certificate, not the internal report, unless a contract says otherwise.
13. Size tiers
| Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large or multi-site: Quillmere Group (2,400 staff, 6 sites) |
|---|---|---|---|
| Reports per year | One full-scope report | Four reports, one per process-area audit, plus a yearly summary | One report per site audit and per group function audit, plus a consolidated group report |
| Length and detail | Short; whole populations sampled, so extent is exact | Medium; sampling rule stated per population | Site reports follow a common format so findings can be compared and aggregated |
| Audit team section | External contract auditor plus one trained staff member | Internal audit pool from other departments | Auditors from other sites, integrated with ISO 9001 and ISO 22301 audits |
| Distribution | CEO and steering committee | Process owners, ISMS manager, steering committee | Site management, CISO, group steering committee, regional legal where findings touch local law |
| Management review input | Report itself | Yearly summary of the four audits | Consolidated themes across sites, repeat findings, site comparison |
14. Records and evidence
| Record | Proves | Owner | Location | Retention (Example) |
|---|---|---|---|---|
| Issued audit report (this document) | Results reported to relevant management | Audit programme manager | ISMS audit folder, read-only | Current certification cycle plus 3 years |
| Completed checklist DOC-ISMS-083 and evidence files | Findings are based on sampled evidence | Lead auditor | Same folder, restricted | Same |
| Distribution record | Report reached relevant management | Audit programme manager | Repository access log or sent list | Same |
| Findings register entries DOC-ISMS-086 | Findings tracked to closure | ISMS manager | Findings register | Same |
| Corrective action records DOC-ISMS-087 | Nonconformities handled under clause 10.2 | Process owners | CAPA records | Same |
| Management review minutes DOC-ISMS-085 | Audit results considered by top management | ISMS manager | Management review records | Same |
15. References
| Reference | Edition and status (as of November 2026) | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | Current; Amd 1 published 2024-02-23 | Clause 9.2, audit criteria |
| ISO 19011:2026 | Current, published 2026-05-27 | Audit reporting, sampling, follow-up |
| ISO/IEC 27007:2020 | Current; a revision is in progress, check for a newer edition | ISMS-specific audit guidance |
| ISO/IEC 17021-1:2015 | Current | Major and minor nonconformity concepts used in grading |
compliance/internal-audit-program | DOC-ISMS-082 | Programme |
isms/isms-internal-audit-checklist | DOC-ISMS-083 | Questions, sampling and grading |
isms/audit-findings-register | DOC-ISMS-086 | Finding IDs and status |
compliance/capa-nonconformity | DOC-ISMS-087 | Corrective action records |
isms/continual-improvement-register | DOC-ISMS-088 | OFIs |
compliance/management-review | DOC-ISMS-085 | Audit results as input |
Official text (purchase or licensed access): ISO/IEC 27001 https://www.iso.org/standard/82875.html and Amd 1 https://www.iso.org/standard/88435.html; ISO 19011 https://www.iso.org/standard/88984.html; ISO/IEC 27007 https://www.iso.org/standard/77802.html; ISO/IEC 17021-1 https://www.iso.org/standard/61651.html.
Standard and licence note
Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clause 9.2 (internal audit), with reporting practice following ISO 19011:2026 and ISO/IEC 27007:2020. The report structure, grading definitions, field descriptions and worked example are original wording written for this template; no ISO or IEC text, tables or definitions are reproduced. Use the official standards, which are copyrighted and sold by ISO, IEC and national standards bodies, as the audit criteria. Check the current editions before use: ISO/IEC 27007 is under revision. An internal audit report does not certify anything; certification decisions belong to the accredited certification body. Template licence: MIT.
関連テンプレート
ISMS Internal Audit Checklist Template (ISO/IEC 27001 clause 9.2)
Audit questions and evidence for clauses 4-10, Annex A audit trails and rotation, sample sizes, interview guide, finding grading (MAJ, MIN, OBS, OFI)
ISMS・ISO/IEC 27001Audit Findings Register Template (ISO/IEC 27001 9.2 and 10.2)
One register for internal, certification body, customer and assessment findings: ID convention, grades, fields, status workflow, links to CAPA, reporting
ISMS・ISO/IEC 27001ISO/IEC 27001 Certification Audit Explained Template
Learning guide: accreditation, choosing a CB, audit time, Stage 1 and 2, findings, decision, surveillance, recertification, transfers, remote audits