# ISMS Internal Audit Report: [Organization name] [IA-YYYY-NN]

> Report format for one internal audit of an information security
> management system (ISMS) under ISO/IEC 27001:2022 + Amd 1:2024,
> clause 9.2 (internal audit). An audit only counts if the managers who
> can act on it see the outcome and a record of it survives for the
> next auditor. This report records the scope and criteria,
> the audit team and its independence, the sampling, the findings with
> evidence and clause references, the conclusions, the distribution and
> the follow-up. Method follows the guidance of ISO 19011:2026 and
> ISO/IEC 27007:2020. Replace every `[bracketed]` value and every row
> marked *Example*.

<!--
Guidance: How to use this template
- When to use: once per audit in the internal audit programme
  (`compliance/internal-audit-program`, DOC-ISMS-082), after the
  closing meeting. Work from the completed checklist
  (`isms/isms-internal-audit-checklist`, DOC-ISMS-083).
- Fill first: section 2 (scope and criteria) and section 3 (team and
  independence), then each finding in section 7. Write the executive
  summary last.
- The main pitfall is a finding that cannot be re-checked: "access
  reviews are weak" is an opinion. Name the requirement, the evidence
  with record IDs and the extent ("2 of 9 sampled leavers").
- Every finding gets an ID from the audit findings register
  (`isms/audit-findings-register`, DOC-ISMS-086). Nonconformities go
  on to corrective action records (`compliance/capa-nonconformity`,
  DOC-ISMS-087); opportunities for improvement go to the continual
  improvement register (`isms/continual-improvement-register`,
  DOC-ISMS-088). A summary of all audits is an input to management
  review (`compliance/management-review`, DOC-ISMS-085).
- The worked example follows one audit at Quillmere Analytics Ltd
  (fictional, 46 staff) in March 2027.
-->

## Document control

<!-- Guidance: The report is a record. Once issued, do not edit it: correct a factual error by issuing a new version with the change explained in the revision history. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-084 |
| Audit reference | [IA-YYYY-NN] *(Example: IA-2027-01)* |
| Version | [1.0] |
| Status | [Draft for factual review / Issued / Superseded] |
| Owner | [@audit-programme-manager] |
| Approvers/reviewers | [@lead-auditor] (author), [@isms-manager] (factual review), [@ceo or steering committee chair] (receives) |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 clause 9.2; guidance ISO 19011:2026 and ISO/IEC 27007:2020 |
| Audit dates | YYYY-MM-DD to YYYY-MM-DD |
| Audit programme reference | DOC-ISMS-082 [programme period], audit [A-NN] |
| Checklist reference | DOC-ISMS-083, completed copy [file name] |
| Next scheduled review | Not applicable for an issued report; the master format is reviewed with DOC-ISMS-082 on YYYY-MM-DD |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Lead auditor | [@lead-auditor] | [Prepared and signed] | YYYY-MM-DD |
| ISMS manager | [@isms-manager] | [Facts confirmed / Facts disputed, see section 9.4] | YYYY-MM-DD |
| Audit programme manager | [@audit-programme-manager] | [Issued] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.9 *(Example)* | 2027-03-25 | [@lead-auditor] | Draft for factual review |
| 1.0 *(Example)* | 2027-03-29 | [@lead-auditor] | Issued; AF-2027-003 extent corrected from 3 to 2 documents after factual review |
| [x.y] | YYYY-MM-DD | [@author] | [Change] |

## Contents

<!-- Guidance: Readers in top management read section 1 and section 9; process owners read section 7; the certification body reads all of it. -->

1. Executive summary
2. Audit objectives, scope and criteria
3. Audit team, independence and impartiality
4. Audit plan and method
5. Sampling and evidence reviewed
6. Summary of findings
7. Detailed findings
8. Positive practices
9. Conclusions
10. Follow-up of previous findings
11. Corrective action and follow-up
12. Distribution and confidentiality
13. Size tiers
14. Records and evidence
15. References

## 1. Executive summary

<!-- Guidance: Half a page for top management. Questions to answer: was the audit completed as planned, how many findings of each grade, is the ISMS conforming and effective for the audited scope, what needs a decision? Pitfall: a summary that only lists findings and gives no conclusion. -->

[Two or three short paragraphs: what was audited, the overall conclusion, the most important findings, any decision needed from top management.]

*Example (Quillmere Analytics Ltd, IA-2027-01):* The internal audit on 15 to 17 March 2027 covered clauses 4 to 10 of ISO/IEC 27001:2022 + Amd 1:2024 and 30 Annex A controls from the 2027 rotation set. The audit found 0 major nonconformities, 2 minor nonconformities, 1 observation and 1 opportunity for improvement.

The ISMS conforms to the standard and to the organization's own requirements for most of the audited scope and is effectively implemented in risk management, incident handling, supplier management and backup. Two weaknesses need corrective action before the Stage 2 audit planned for May 2027 (2027-05-10 to 12): measurement results are collected but not analysed or evaluated (clause 9.1), and access for departing contractors is removed late because contractor departures do not reach IT through the HR leaver process (control A.5.18 as implemented by the access control policy).

Decision needed: top management to confirm the owner for contractor offboarding, which today sits between Finance (contracts) and Engineering Operations (accounts).

## 2. Audit objectives, scope and criteria

<!-- Guidance: Copy from the audit plan and the checklist, then record any change made during the audit. An auditor checks that the scope matches the programme entry. Before the first Stage 2, confirm with the certification body what internal audit coverage it expects (CB practice: often all clauses plus a sample from every Annex A theme) and record how any theme outside this audit is covered. -->

| Item | Value |
|---|---|
| Objectives | [List] *(Example: confirm conformity of clauses 4 to 10 before Stage 2; test the operation of the 2027 Annex A rotation set; check readiness evidence for the certification audit)* |
| Clauses in scope | [4 to 10] |
| Annex A controls in scope | [List or set name] *(Example: 30 controls in the 2027 rotation set, trails TR-01, TR-03, TR-04, TR-05, TR-10, TR-11; the 7 controls re-sampled every year, A.5.15 to A.5.18, A.8.8, A.8.13 and A.8.24, are part of this set)* |
| Sites, services, teams | [List] *(Example: head office, remote staff, production on the public cloud primary and DR regions, customer support)* |
| Record period | YYYY-MM-DD to YYYY-MM-DD *(Example: 2026-09-01 to 2027-02-28)* |
| Audit criteria | ISO/IEC 27001:2022 + Amd 1:2024; Statement of Applicability DOC-ISMS-011 version [x]; information security policy DOC-ISMS-001; topic policies in DOC-ISMS-005; legal, regulatory and contractual requirements in DOC-ISMS-014 |
| Out of scope for this audit | [List with reason] *(Example: A.7 controls at the office, scheduled for the 2029 walk-through)* |
| Changes to scope during the audit | [None / description and reason] |

## 3. Audit team, independence and impartiality

<!-- Guidance: Clause 9.2.2 is where an auditor checks that internal auditors had no stake in what they reviewed. Show who audited what and confirm nobody audited their own work. -->

| Role | Name or role | Competence evidence | Areas audited | Areas excluded for independence |
|---|---|---|---|---|
| Lead auditor | [@lead-auditor] | [Training, prior audits] | [Clauses, trails] | [Areas] |
| Auditor | [@auditor] | [Training, prior audits] | [Clauses, trails] | [Areas] |
| Lead auditor *(Example)* | External contract auditor | ISO/IEC 27001 lead auditor training, competence record in DOC-ISMS-026 | Clauses 4 to 10, TR-01, TR-04, TR-05, TR-11 | None |
| Auditor *(Example)* | Finance Manager (trained internal auditor) | Internal auditor course 2026, one shadow audit | TR-03, TR-10, clause 7 | TR-04 supplier trail and A.5.19 to A.5.23, because Finance runs procurement |
| Not on team *(Example)* | Head of Engineering Operations (0.5 FTE ISMS manager) | | | All: manages the ISMS and the audit programme; clause 9.2 was audited by the lead auditor |

Confirmations:

- [ ] No auditor audited a process they operate, designed or manage.
- [ ] Clause 9.2 was audited by someone other than the audit programme manager.
- [ ] Audit evidence was stored in the agreed restricted location.
- [ ] Any AI-based tool used to summarise evidence was agreed in the audit plan and its output checked against source records. [Not used / Tool and use]

## 4. Audit plan and method

<!-- Guidance: Record how the audit was done and anything that limited it. Questions to answer: on site or remote, which tools, which interviews, what was not available? -->

| Item | Value |
|---|---|
| Method | [On site / Remote / Blended] *(Example: blended, day 1 on site at the office, days 2 and 3 remote with screen sharing)* |
| Remote platform and rules | [Platform category, recording rules] *(Example: company video meeting tool, no recording, evidence exported by the auditee and uploaded to the audit folder)* |
| Opening meeting | YYYY-MM-DD, attendees by role |
| Closing meeting | YYYY-MM-DD, attendees by role |
| Interviews | [Number and roles] *(Example: 11 interviews: CEO, ISMS manager, 2 risk owners, 3 control owners, HR lead, 3 staff from sales, support and engineering)* |
| Limitations | [None / description] *(Example: cloud provider assurance report for the DR region not available during the audit, received 2027-03-19 and reviewed before the report was issued)* |

```mermaid
gantt
  title Example audit timeline IA-2027-01
  dateFormat YYYY-MM-DD
  section Prepare
  Plan_and_document_request :p1, 2027-02-15, 14d
  Desk_review :p2, after p1, 7d
  Sampling_plan_issued :p3, after p2, 2d
  section Audit
  Fieldwork_and_closing :a1, 2027-03-15, 3d
  section Report
  Draft_report :r1, after a1, 7d
  Factual_review :r2, after r1, 4d
  Report_issued :milestone, r3, 2027-03-29, 0d
  section Follow_up
  Corrective_action_plans :f1, 2027-03-29, 30d
  Follow_up_verification :f2, 2027-05-17, 5d
```

## 5. Sampling and evidence reviewed

<!-- Guidance: State the method and size of each sample so a reader can judge the strength of the conclusions. ISO 19011 describes judgement-based and statistical sampling; most internal audits use judgement. Do not claim statistical confidence you did not compute. -->

| Population | Size | Sample | Method | Result |
|---|---|---|---|---|
| [Population] | [n] | [n] | [Whole / Judgement / Random / Data analytics] | [Exceptions] |
| Leavers, record period *(Example)* | 9 (7 employees, 2 contractors) | 9 | Whole population | 2 exceptions (AF-2027-002) |
| Joiners, record period *(Example)* | 11 | 5 | Judgement: 3 engineers with production access, 2 random | 0 exceptions |
| Production changes *(Example)* | 214 | 10 | Random 8 by change ID plus 2 emergency changes | 0 exceptions |
| Critical vulnerabilities *(Example)* | 17 | 5 | Judgement: oldest 5 | 0 exceptions outside the policy deadline |
| Suppliers *(Example)* | 31 | 5 | Judgement: 3 critical plus 2 random | 0 exceptions |
| Endpoints *(Example)* | 52 | 5 | Random from the MDM inventory | 0 exceptions |
| Risks in the register *(Example)* | 64 | 5 | Judgement: 3 High, 2 Medium | Scores reproduced correctly |
| Controlled documents *(Example)* | 38 | 5 | Random from DOC-ISMS-028 | 2 superseded copies found outside the repository (AF-2027-003) |

Documents reviewed: [list with IDs and versions]. *Example:* DOC-ISMS-001 v2.0, DOC-ISMS-002 v1.2, DOC-ISMS-010 v2.0, DOC-ISMS-011 v1.1, DOC-ISMS-013 v1.3, DOC-ISMS-016 (export 2027-03-10), DOC-ISMS-024 v1.0, DOC-ISMS-041 v1.0, DOC-ISMS-080 v1.0.

## 6. Summary of findings

<!-- Guidance: Counts must match section 7. Grades follow the definitions in the audit programme and in the checklist section 15. -->

| Grade | Count | Finding IDs |
|---|---|---|
| Major nonconformity (MAJ) | [n] *(Example: 0)* | [IDs] |
| Minor nonconformity (MIN) | [n] *(Example: 2)* | [IDs] *(Example: AF-2027-001, AF-2027-002)* |
| Observation (OBS) | [n] *(Example: 1)* | [IDs] *(Example: AF-2027-003)* |
| Opportunity for improvement (OFI) | [n] *(Example: 1)* | [IDs] *(Example: AF-2027-004)* |
| **Total** | [n] *(Example: 4)* | |

Results by clause *(Example, from checklist section 17)*:

| Clause | Questions | C | MAJ | MIN | OBS | OFI (with C) |
|---|---|---|---|---|---|---|
| 4 Context | 4 | 4 | 0 | 0 | 0 | 0 |
| 5 Leadership | 3 | 3 | 0 | 0 | 0 | 0 |
| 6 Planning | 5 | 5 | 0 | 0 | 0 | 1 |
| 7 Support | 7 | 6 | 0 | 0 | 1 | 0 |
| 8 Operation | 3 | 3 | 0 | 0 | 0 | 0 |
| 9 Performance evaluation | 6 | 5 | 0 | 1 | 0 | 0 |
| 10 Improvement | 2 | 2 | 0 | 0 | 0 | 0 |
| **Total** | **30** | **28** | **0** | **1** | **1** | **1** |
| Annex A controls sampled | 30 | 29 | 0 | 1 | 0 | 0 |

## 7. Detailed findings

<!-- Guidance: One block per finding. Write the requirement, the evidence and the statement of nonconformity separately. Add the extent and the risk so the owner can prioritise. Pitfall: recommending a specific solution; the owner chooses the corrective action after root cause analysis. -->

### 7.1 Finding format

| Field | Content |
|---|---|
| Finding ID | AF-YYYY-NNN (from DOC-ISMS-086) |
| Grade | MAJ / MIN / OBS / OFI |
| Requirement | Clause, Annex A control as applied in the SoA, or policy section |
| Evidence | What was seen, with record IDs and dates |
| Extent | Exceptions out of sample, and sample out of population |
| Statement | What is missing or not met, in one sentence |
| Risk or effect | Why it matters, with risk register ID where one exists |
| Owner | Process owner who will respond |
| Response due | Date for the correction and corrective action plan |

### 7.2 Findings

**AF-2027-001 *(Example)*: Minor nonconformity, clause 9.1**

| Field | Content |
|---|---|
| Requirement | Clause 9.1: metric results have to be looked at on a set schedule and used to judge how well the ISMS is working; measurement programme DOC-ISMS-080 requires a monthly review of metric results by the ISMS manager |
| Evidence | Metric extracts for December 2026, January 2027 and February 2027 exist in the ISMS folder. No record of analysis, evaluation or decisions for any of the three months. Interview with the ISMS manager confirmed the reviews did not take place because of release workload |
| Extent | 3 of 3 monthly reviews in the sampled period missing |
| Statement | Measurement results are collected but are not analysed or evaluated as the organization planned |
| Risk or effect | Management review in April 2027 would lack evaluated performance information; trends such as rising patch times would go unnoticed |
| Owner | ISMS manager |
| Response due | 2027-04-28 |

**AF-2027-002 *(Example)*: Minor nonconformity, control A.5.18 as implemented by the access control policy**

| Field | Content |
|---|---|
| Requirement | SoA DOC-ISMS-011 marks A.5.18 Implemented; access control policy DOC-ISMS-041 requires all access of a leaver to be removed within 1 business day of the last working day |
| Evidence | HR leaver list and identity provider audit log export of 2027-03-16. Seven employee leavers removed on the last working day. Two contractor leavers removed 4 and 6 business days late; the requests came from the engineering manager, not from HR |
| Extent | 2 of 9 leavers (both contractors, 2 of 2 contractor leavers) |
| Statement | Access of departing contractors is not removed within the time the policy requires |
| Risk or effect | Former contractors kept access to the code repository and the support tool after leaving; linked risk R-018 (unauthorised access by former personnel) |
| Owner | Head of Engineering Operations, with Finance for contractor contracts |
| Response due | 2027-04-28 |

**AF-2027-003 *(Example)*: Observation, clause 7.5.3**

| Field | Content |
|---|---|
| Requirement | Clause 7.5.3: ISMS documents are kept under control, so old versions do not stay in circulation and records are kept and disposed of on purpose; the document control rules recorded with the documented information register DOC-ISMS-028 require superseded versions to be withdrawn from use |
| Evidence | The document repository holds the current versions with correct approval records. A shared team drive holds copies of two superseded topic policies (remote working v0.9, acceptable use v1.0), last opened in January 2027 |
| Extent | 2 of 38 controlled documents have uncontrolled superseded copies |
| Statement | Superseded copies outside the repository could be used by mistake |
| Owner | ISMS manager |
| Response due | Decision by 2027-04-28 |

**AF-2027-004 *(Example)*: Opportunity for improvement, clause 6.2**

| Field | Content |
|---|---|
| Requirement | Clause 6.2 is met: objectives are set, measurable and monitored |
| Observation | Four of the six objectives in DOC-ISMS-024 have targets but no baseline value, so progress is hard to show at management review |
| Suggestion | Record a baseline for each objective when it is set |
| Owner | ISMS manager, logged as CI-2027-007 in DOC-ISMS-088 |

## 8. Positive practices

<!-- Guidance: Record what works well, with evidence. It helps the organization keep good practice when people change, and it gives a balanced picture to top management. -->

| Area | Practice | Evidence |
|---|---|---|
| [Area] | [Practice] | [Evidence] |
| Backup *(Example)* | Quarterly restore tests completed on time, with restore time measured against the target | DOC-ISMS-071, four quarters |
| Risk management *(Example)* | Every sampled risk had an owner, a reproducible score and a treatment decision traceable to the SoA | DOC-ISMS-016, 5 of 5 risks |
| Incident handling *(Example)* | Both incidents in the period had a post-incident review with actions closed | DOC-ISMS-021, DOC-ISMS-022 |

## 9. Conclusions

<!-- Guidance: Clause 9.2.1 wants two answers: does the ISMS meet the standard and your own rules, and does it actually work day to day? Answer both for the audited scope, state whether the audit objectives were met and give any limits. An auditor checks that the conclusion follows from the findings. -->

### 9.1 Conformity

[Statement on conformity with ISO/IEC 27001:2022 + Amd 1:2024 and with the organization's own requirements, for the audited scope.]

*Example:* The ISMS conforms to the requirements of clauses 4 to 10 for the audited scope, except for clause 9.1 (AF-2027-001). The sampled Annex A controls operate as described in the SoA, except A.5.18 for contractor leavers (AF-2027-002).

### 9.2 Effectiveness

[Statement on whether the ISMS is effectively implemented and maintained, and whether it achieves its intended results.]

*Example:* The ISMS is effectively implemented and maintained. Risk management, incident handling, supplier management and backup produce reliable records. Performance evaluation is the weakest process and needs correction so that the first management review before Stage 2 is based on evaluated data.

### 9.3 Objectives and limits

| Objective | Met? | Comment |
|---|---|---|
| [Objective from section 2] | [Yes / Partly / No] | [Comment] |
| Conformity of clauses 4 to 10 before Stage 2 *(Example)* | Yes | Two minor findings to close before Stage 2 |
| Operation of the 2027 Annex A rotation set *(Example)* | Yes | 30 of 30 controls tested |
| Readiness evidence for the certification audit *(Example)* | Partly | Management review not yet held; planned for April 2027 |

Limits on the evidence: [None / description]. *Example:* judgement-based samples; the conclusions apply to the sampled period and items and do not give statistical assurance over the whole population.

### 9.4 Disputed facts

[None / finding ID, the auditee's position and the lead auditor's response.]

## 10. Follow-up of previous findings

<!-- Guidance: Check every open finding from earlier internal audits, certification body audits and other assessments. A finding closed without evidence of effectiveness is reopened. -->

| Finding ID | Source | Grade | Status at this audit | Effective? | Evidence |
|---|---|---|---|---|---|
| [AF-YYYY-NNN] | [Internal audit / CB / Customer / Assessment] | [Grade] | [Open / Closed] | [Yes / No, reopened / Not yet verifiable] | [Record] |
| AF-2026-006 *(Example)* | Gap assessment DOC-ISMS-098 | MIN | Closed 2026-12-10 | Yes: 3 of 3 sampled supplier contracts now include security clauses | Contracts SUP-004, SUP-011, SUP-019 |
| AF-2026-009 *(Example)* | Internal audit IA-2026-02 | OBS | Open | Not yet verifiable | Asset inventory review planned April 2027 |

## 11. Corrective action and follow-up

<!-- Guidance: Agree the response dates at the closing meeting. Every nonconformity gets a corrective action record with root cause analysis; observations get an owner decision; OFIs go to the improvement register. -->

| Finding ID | Response | Record | Owner | Plan due | Verification method | Verification due |
|---|---|---|---|---|---|---|
| [AF-YYYY-NNN] | [Correction and corrective action / Decision / Evaluation] | [NC-YYYY-NNN / CI-YYYY-NNN] | [@owner] | YYYY-MM-DD | [Method] | YYYY-MM-DD |
| AF-2027-001 *(Example)* | Corrective action | NC-2027-004 | ISMS manager | 2027-04-28 | Review the April and May 2027 metric reviews | 2027-05-21 |
| AF-2027-002 *(Example)* | Corrective action | NC-2027-005 | Head of Engineering Operations | 2027-04-28 | Re-sample all contractor and employee leavers since the fix | 2027-05-21 |
| AF-2027-003 *(Example)* | Owner decision | DOC-ISMS-086 entry | ISMS manager | 2027-04-28 | Check shared drives for superseded copies | Next audit |
| AF-2027-004 *(Example)* | Evaluation | CI-2027-007 | ISMS manager | 2027-04-28 | Improvement register status | Next management review |

```mermaid
sequenceDiagram
  participant LA as Lead auditor
  participant PO as Process owner
  participant IM as ISMS manager
  participant TM as Top management
  LA->>PO: Finding with evidence at closing meeting
  LA->>IM: Issued report and register entries
  PO->>IM: Correction, root cause and action plan
  IM->>PO: Plan accepted
  PO->>LA: Evidence that actions are complete
  LA->>IM: Effectiveness verified or finding reopened
  IM->>TM: Audit results summary for management review
```

## 12. Distribution and confidentiality

<!-- Guidance: Under clause 9.2.2 the managers who can fix what the audit found must get the results. Decide who receives the full report and who receives extracts. Audit reports can reveal weaknesses: classify and store them accordingly. -->

| Recipient | Content | Format | Date sent |
|---|---|---|---|
| [Top management / steering committee] | [Full report / summary] | [Format] | YYYY-MM-DD |
| CEO and steering committee *(Example)* | Full report | Repository link, restricted group | 2027-03-29 |
| Process owners with findings *(Example)* | Sections 7 and 11 for their findings | Repository link | 2027-03-29 |
| Certification body *(Example)* | Full report on request during Stage 1 and Stage 2 | Shared during the audit, not e-mailed | On request |

Classification: [Confidential]. Do not share the report outside the distribution list without approval from the ISMS manager. Customers asking for audit evidence receive a summary or the certificate, not the internal report, unless a contract says otherwise.

## 13. Size tiers

<!-- Guidance: The report structure is the same for every organization; what changes is the number of reports, how they are consolidated and who reads them. -->

| Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large or multi-site: Quillmere Group (2,400 staff, 6 sites) |
|---|---|---|---|
| Reports per year | One full-scope report | Four reports, one per process-area audit, plus a yearly summary | One report per site audit and per group function audit, plus a consolidated group report |
| Length and detail | Short; whole populations sampled, so extent is exact | Medium; sampling rule stated per population | Site reports follow a common format so findings can be compared and aggregated |
| Audit team section | External contract auditor plus one trained staff member | Internal audit pool from other departments | Auditors from other sites, integrated with ISO 9001 and ISO 22301 audits |
| Distribution | CEO and steering committee | Process owners, ISMS manager, steering committee | Site management, CISO, group steering committee, regional legal where findings touch local law |
| Management review input | Report itself | Yearly summary of the four audits | Consolidated themes across sites, repeat findings, site comparison |

## 14. Records and evidence

<!-- Guidance: The issued report, the completed checklist and the evidence files together are the record of the audit that clause 9.2.2 looks for. Link them in the control evidence matrix (`isms/control-evidence-matrix`, DOC-ISMS-033). -->

| Record | Proves | Owner | Location | Retention *(Example)* |
|---|---|---|---|---|
| Issued audit report (this document) | Results reported to relevant management | Audit programme manager | ISMS audit folder, read-only | Current certification cycle plus 3 years |
| Completed checklist DOC-ISMS-083 and evidence files | Findings are based on sampled evidence | Lead auditor | Same folder, restricted | Same |
| Distribution record | Report reached relevant management | Audit programme manager | Repository access log or sent list | Same |
| Findings register entries DOC-ISMS-086 | Findings tracked to closure | ISMS manager | Findings register | Same |
| Corrective action records DOC-ISMS-087 | Nonconformities handled under clause 10.2 | Process owners | CAPA records | Same |
| Management review minutes DOC-ISMS-085 | Audit results considered by top management | ISMS manager | Management review records | Same |

## 15. References

<!-- Guidance: Cite editions exactly; check for new editions at each annual review. -->

| Reference | Edition and status (as of November 2026) | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | Current; Amd 1 published 2024-02-23 | Clause 9.2, audit criteria |
| ISO 19011:2026 | Current, published 2026-05-27 | Audit reporting, sampling, follow-up |
| ISO/IEC 27007:2020 | Current; a revision is in progress, check for a newer edition | ISMS-specific audit guidance |
| ISO/IEC 17021-1:2015 | Current | Major and minor nonconformity concepts used in grading |
| `compliance/internal-audit-program` | DOC-ISMS-082 | Programme |
| `isms/isms-internal-audit-checklist` | DOC-ISMS-083 | Questions, sampling and grading |
| `isms/audit-findings-register` | DOC-ISMS-086 | Finding IDs and status |
| `compliance/capa-nonconformity` | DOC-ISMS-087 | Corrective action records |
| `isms/continual-improvement-register` | DOC-ISMS-088 | OFIs |
| `compliance/management-review` | DOC-ISMS-085 | Audit results as input |

Official text (purchase or licensed access): ISO/IEC 27001 https://www.iso.org/standard/82875.html and Amd 1 https://www.iso.org/standard/88435.html; ISO 19011 https://www.iso.org/standard/88984.html; ISO/IEC 27007 https://www.iso.org/standard/77802.html; ISO/IEC 17021-1 https://www.iso.org/standard/61651.html.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clause 9.2 (internal audit), with reporting practice following ISO 19011:2026 and ISO/IEC 27007:2020. The report structure, grading definitions, field descriptions and worked example are original wording written for this template; no ISO or IEC text, tables or definitions are reproduced. Use the official standards, which are copyrighted and sold by ISO, IEC and national standards bodies, as the audit criteria. Check the current editions before use: ISO/IEC 27007 is under revision. An internal audit report does not certify anything; certification decisions belong to the accredited certification body. Template licence: MIT.