# Audit Findings Register: [Organization name]

> One register for every finding raised against the information
> security management system (ISMS): internal audits, certification
> body audits, customer audits, regulator reviews and assessments such
> as penetration tests, gap assessments and independent reviews. It
> supports ISO/IEC 27001:2022 + Amd 1:2024 clauses 9.2 (internal
> audit), 9.3.2 (management review inputs on audit results and
> nonconformity trends) and 10.2 (nonconformity and corrective action),
> and control A.5.35 (independent review). Replace every `[bracketed]`
> value and every row marked *Example*.

<!--
Guidance: How to use this template
- When to use: from the first gap assessment onwards. Every finding,
  whatever its source, gets one row and one ID here, so top management
  sees one list and the certification body sees one trail.
- Fill first: the ID convention and grades in sections 2 and 3, then
  enter open findings from the latest audit reports.
- The register tracks findings; it does not replace the corrective
  action record. Each nonconformity links to a record in
  `compliance/capa-nonconformity` (DOC-ISMS-087) where the root cause
  and effectiveness check are written. OFIs link to
  `isms/continual-improvement-register` (DOC-ISMS-088).
- Main pitfall: closing a finding when the action is done instead of
  when its effectiveness has been verified.
- Related: `isms/isms-internal-audit-report` (DOC-ISMS-084),
  `isms/isms-internal-audit-checklist` (DOC-ISMS-083),
  `isms/certification-findings-action-plan` (DOC-ISMS-093).
-->

## Document control

<!-- Guidance: The register is a living record. Version the structure (fields, grades, workflow); the rows change daily and are tracked by the tool's history or by monthly snapshots. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-086 |
| Version | [1.0] |
| Status | [Draft / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@audit-programme-manager], [@ciso or steering committee chair] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 clauses 9.2, 9.3, 10.2; control A.5.35 |
| Next scheduled review | YYYY-MM-DD |
| Register tool | [Spreadsheet / ticketing project / GRC tool] |
| Snapshot frequency | [Monthly, kept as records] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Top management sponsor | [@ceo or delegate] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | 2027-01-20 | [@isms-manager] | First approved register structure |
| 1.1 *(Example)* | 2027-04-05 | [@isms-manager] | Added customer audit source and repeat-finding flag |
| [x.y] | YYYY-MM-DD | [@author] | [Change] |

## 1. Purpose and scope

<!-- Guidance: State which sources feed the register. An auditor checks that certification body findings and internal findings are tracked the same way. -->

This register records each finding about the ISMS of [Organization name], its grade, owner, status and link to corrective or improvement action, from the moment it is raised until its effectiveness is verified. It covers the ISMS scope in DOC-ISMS-002 and all sources listed in section 2.

## 2. Sources and ID convention

<!-- Guidance: Use one ID series for all sources, with the source in its own field. One series makes trends and repeat findings visible. -->

IDs use the form **AF-YYYY-NNN**: year raised and a sequence number that never resets within the year. Keep the external reference (for example the certification body's finding number) in its own field.

| Source code | Source | Typical origin |
|---|---|---|
| IA | Internal audit | Internal audit report DOC-ISMS-084 |
| CB | Certification body audit | Stage 1, Stage 2, surveillance or recertification report |
| CUS | Customer audit or questionnaire follow-up | Customer audit report, contract review |
| REG | Regulator or supervisory review | Inspection letter |
| ASM | Assessment | Gap assessment DOC-ISMS-098, independent review DOC-ISMS-048, penetration test report |
| MR | Management review | Action raised in DOC-ISMS-085 that concerns a nonconformity |

## 3. Grades

<!-- Guidance: Use the same grades as the internal audit checklist (section 15). For certification body findings, record the grade the CB gave; do not regrade it. -->

| Grade | Code | Meaning in this register | Required link |
|---|---|---|---|
| Major nonconformity | MAJ | Required process or control absent or broken down, or a systemic failure | Corrective action record DOC-ISMS-087 |
| Minor nonconformity | MIN | Isolated failure to meet a requirement | Corrective action record DOC-ISMS-087 |
| Observation | OBS | Requirement met, weakness that could lead to a nonconformity | Owner decision recorded in the row |
| Opportunity for improvement | OFI | Requirement met, improvement suggested | Improvement register DOC-ISMS-088 |
| Assessment finding | ASM-H / ASM-M / ASM-L | Technical finding rated High, Medium or Low by the assessor (for example a penetration test) | Vulnerability tracker DOC-ISMS-072 or risk register DOC-ISMS-016 |

Certification body findings follow the CB's own deadlines for corrections and corrective action plans *(Example: 90 days as set by the CB)*. Enter the CB deadline in the due date field.

## 4. Fields

<!-- Guidance: Keep the field set small enough that people maintain it. An auditor checks requirement, evidence, owner, dates and the link to the corrective action. -->

| Field | Content |
|---|---|
| ID | AF-YYYY-NNN |
| Source and reference | Source code and the report or finding number |
| Date raised | YYYY-MM-DD |
| Grade | Section 3 |
| Requirement | Clause, Annex A control as applied in the SoA, policy section or contract clause |
| Finding summary | One sentence, with extent |
| Owner | Process owner accountable for the response |
| Linked record | NC-YYYY-NNN, CI-YYYY-NNN, VUL-NNN or RISK-NNN |
| Due date | Plan due and completion due |
| Status | Section 5 |
| Verified by and date | Who checked effectiveness, when |
| Repeat | Yes when a finding with the same requirement and cause was closed in the last 24 months *(Example period)* |

## 5. Status workflow

<!-- Guidance: Status moves forward only, except Reopened. Closing a nonconformity (MAJ or MIN) or an assessment finding needs a verifier who is not the owner. An OBS or OFI row can be closed by the ISMS manager once the owner decision is carried out or the improvement entry exists; the next audit checks it. -->

```mermaid
stateDiagram-v2
  [*] --> Open
  Open --> Planned: owner submits response plan
  Planned --> InProgress: plan accepted by ISMS manager
  InProgress --> AwaitingVerification: owner reports actions complete
  AwaitingVerification --> Closed: effectiveness verified
  AwaitingVerification --> Reopened: not effective
  Reopened --> Planned: revised plan
  Open --> Merged: same root cause as another finding
  Merged --> [*]
  Closed --> [*]
```

| Status | Entry rule |
|---|---|
| Open | Finding entered with source, grade and owner |
| Planned | Correction and corrective action plan (or owner decision for OBS, or evaluation link for OFI) recorded |
| InProgress | Plan accepted by the ISMS manager; for CB findings, plan accepted by the CB when it asks for this |
| AwaitingVerification | Owner provides evidence that actions are complete |
| Closed | Verifier (not the owner, for MAJ, MIN and ASM rows) confirms the action worked, with evidence; for a major CB finding, the CB's verification is recorded; OBS and OFI rows close when the decision is carried out or the CI entry exists |
| Reopened | Verification failed; reason recorded |
| Merged | Linked to the surviving finding ID; not counted again |

## 6. Register

<!-- Guidance: One row per finding. The example rows follow Quillmere Analytics Ltd (fictional, 46 staff) in its certification year. Replace them. -->

| ID | Source and ref | Raised | Grade | Requirement | Finding summary | Owner | Linked record | Due | Status | Verified | Repeat |
|---|---|---|---|---|---|---|---|---|---|---|---|
| AF-2027-001 *(Example)* | IA, IA-2027-01 | 2027-03-17 | MIN | 9.1 | Metric results not analysed or evaluated, 3 of 3 months | ISMS manager | NC-2027-004 | 2027-04-28 / 2027-05-21 | Closed | Lead auditor, 2027-05-20 | No |
| AF-2027-002 *(Example)* | IA, IA-2027-01 | 2027-03-17 | MIN | A.5.18, DOC-ISMS-041 | Contractor access removed late, 2 of 9 leavers | Head of Engineering Operations | NC-2027-005 | 2027-04-28 / 2027-05-21 | Closed | Lead auditor, 2027-05-20 | No |
| AF-2027-003 *(Example)* | IA, IA-2027-01 | 2027-03-17 | OBS | 7.5.3 | Superseded copies of 2 policies on a shared drive | ISMS manager | Decision: delete and block copies | 2027-04-28 | Closed | ISMS manager, 2027-04-12 | No |
| AF-2027-004 *(Example)* | IA, IA-2027-01 | 2027-03-17 | OFI | 6.2 | 4 of 6 objectives have no baseline | ISMS manager | CI-2027-007 | 2027-04-28 | Closed | ISMS manager, 2027-03-29 (logged as CI-2027-007) | No |
| AF-2027-005 *(Example)* | CB, Stage 1 report, AOC-01 | 2027-04-16 | OBS | 4.1, 9.3.2 | Climate change decision from 4.1 not recorded in the context record nor reviewed at the management review | ISMS manager | DOC-ISMS-003 v1.2; DOC-ISMS-091 tracker STG1-001 | 2027-04-30 | Closed | ISMS manager, 2027-05-03 | No |
| AF-2027-006 *(Example)* | CUS, customer audit 2027-07 | 2027-07-14 | MIN | Contract security schedule clause 4 | Customer data in support tool exports not deleted after 30 days | Head of Support | NC-2027-009 | 2027-08-13 / 2027-09-30 | InProgress | | No |
| AF-2027-007 *(Example)* | ASM, penetration test 2027-08 | 2027-08-22 | ASM-H | A.8.8 | Outdated web server component on the status page | Head of Engineering Operations | VUL-118 | 2027-09-05 | AwaitingVerification | | No |
| [AF-YYYY-NNN] | [Source, ref] | YYYY-MM-DD | [Grade] | [Requirement] | [Summary with extent] | [@owner] | [Record] | YYYY-MM-DD | [Status] | [@verifier, date] | [Yes / No] |

## 7. Links to corrective action, risk and improvement

<!-- Guidance: The register points to where the work is done. Do not copy root cause analysis into the register. -->

```mermaid
flowchart LR
  A["Finding raised in a report"] --> B["Register row AF-YYYY-NNN"]
  B --> C{"Grade"}
  C -- "MAJ or MIN" --> D["Corrective action record DOC-ISMS-087"]
  C -- "OBS" --> E["Owner decision in the row"]
  C -- "OFI" --> F["Improvement register DOC-ISMS-088"]
  C -- "ASM" --> G["Vulnerability tracker DOC-ISMS-072 or risk register DOC-ISMS-016"]
  D --> H["Verification and closure in the register"]
  E --> H
  F --> H
  G --> H
```

When a finding shows a new or changed risk, add or update the risk in the risk register (DOC-ISMS-016) and note the RISK ID in the linked record field. When the response changes the ISMS itself (a new process, a scope change), plan it through the ISMS change plan (DOC-ISMS-025). Certification body findings are also tracked in the certification findings action plan (DOC-ISMS-093) when the CB asks for a formal plan.

## 8. Reporting

<!-- Guidance: Summarise the register for each management review (clause 9.3.2 lists nonconformity and corrective action trends and audit results among the inputs, and 9.3.3 asks for the resulting decisions to be recorded). -->

Report at least these measures to each management review and to the steering committee (DOC-ISMS-007):

| Measure | Definition | *Example: Quillmere Analytics Ltd at 2027-09-01, 7 findings in 2027* |
|---|---|---|
| Findings by grade | Count per grade raised in the period | MIN 3, OBS 2, OFI 1, ASM-H 1 |
| Open findings | Status not Closed or Merged | 2 (AF-2027-006, AF-2027-007) |
| Overdue | Open and past completion due date | 0 |
| Closed with verification | Closed rows with verifier and date | 5 of 5 closed |
| Repeat findings | Repeat flag Yes | 0 |
| Findings by source | Count per source code | IA 4, CB 1, CUS 1, ASM 1 |

Check: 3 + 2 + 1 + 1 = 7 findings; 2 open + 5 closed = 7; 4 + 1 + 1 + 1 = 7 by source.

## 9. Size tiers

<!-- Guidance: The fields stay the same; the tool, volume and reporting change with size. -->

| Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large or multi-site: Quillmere Group (2,400 staff, 6 sites) |
|---|---|---|---|
| Tool | Spreadsheet with monthly snapshot, or a project in the existing ticketing tool | Ticketing project with workflow states and due-date alerts | GRC tool shared with the ISO 9001 and ISO 22301 systems, site field mandatory |
| Volume *(Example)* | 5 to 15 findings a year | 30 to 60 findings a year, including hospital customer audits | Several hundred across sites and systems |
| Verification | External contract auditor or ISMS manager (not for own findings) | Internal audit pool | Site auditors and group security office |
| Extra fields | None | Customer name for customer audits, regulator reference | Site, management system (ISMS, QMS, BCMS), country |
| Reporting | Monthly to the steering committee | Monthly to the security team, quarterly to the steering committee | Monthly per site, quarterly consolidated to the CISO and group management review |

## 10. Records and evidence

<!-- Guidance: Show the auditor that every finding was tracked to verified closure. Link this register in the control evidence matrix (`isms/control-evidence-matrix`, DOC-ISMS-033). -->

| Record | Proves | Owner | Location | Retention *(Example)* |
|---|---|---|---|---|
| Register and monthly snapshots | Findings tracked from raising to closure | ISMS manager | Register tool, snapshots in the ISMS folder | Current certification cycle plus 3 years |
| Linked corrective action records | Clause 10.2 actions and effectiveness | Process owners | DOC-ISMS-087 records | Same |
| Source reports | Origin and evidence of each finding | Audit programme manager | Audit folder | Same |
| Management review summaries | Trends reported to top management | ISMS manager | DOC-ISMS-085 | Same |

## 11. References

<!-- Guidance: Cite editions exactly. -->

| Reference | Edition and status (as of November 2026) | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | Current; Amd 1 published 2024-02-23 | Clauses 9.2, 9.3, 10.2; control A.5.35 |
| ISO 19011:2026 | Current, published 2026-05-27 | Audit follow-up |
| ISO/IEC 17021-1:2015 | Current | Certification body findings and their handling |
| `isms/isms-internal-audit-report` | DOC-ISMS-084 | Source of internal findings |
| `compliance/capa-nonconformity` | DOC-ISMS-087 | Corrective action records |
| `isms/continual-improvement-register` | DOC-ISMS-088 | OFIs |
| `isms/certification-findings-action-plan` | DOC-ISMS-093 | Certification body findings |
| `isms/vulnerability-remediation-tracker` | DOC-ISMS-072 | Technical assessment findings |

Official text (purchase or licensed access): ISO/IEC 27001 https://www.iso.org/standard/82875.html and Amd 1 https://www.iso.org/standard/88435.html; ISO 19011 https://www.iso.org/standard/88984.html; ISO/IEC 17021-1 https://www.iso.org/standard/61651.html.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 9.2, 9.3 and 10.2 and control A.5.35. Fields, grades, workflow and examples are original wording written for this template; no ISO or IEC text, tables or definitions are reproduced. Use the official standard, which is copyrighted and sold by ISO, IEC and national standards bodies. Check the current edition before use. Template licence: MIT.