# Stage 2 Audit Evidence Index: [Organization name]

> Evidence index and audit-week workbook for the Stage 2 certification
> audit of the information security management system (ISMS) of
> [Organization name] against ISO/IEC 27001:2022 + Amd 1:2024. It lists
> where the evidence for each clause (4 to 10) and each Annex A theme
> sits, prepares the populations auditors sample from, sets the interview
> schedule and the rules for the audit room and for remote evidence, and
> keeps the daily debrief log and the closing meeting notes. Stage 2 is
> run by the certification body (CB) under ISO/IEC 17021-1:2015 and ISO/IEC
> 27006-1:2024. Replace every `[bracketed]` value and every row marked
> *Example*.

<!--
Guidance: How to use this template
- When to use: build it in the weeks between Stage 1 and Stage 2, after
  the Stage 1 areas of concern are closed (`isms/stage-1-readiness-pack`).
  Use it live during the audit week, then keep it as the record of what
  was shown. Re-use the structure for surveillance and recertification
  audits (`isms/surveillance-readiness-health-check`).
- Fill first: section 4 (clause index) and section 6 (sampling
  populations). Auditors test implementation by sampling records; a
  complete, current population list is the fastest way to a smooth audit.
- Main pitfall: pointing to policies as evidence. Stage 2 tests whether
  the ISMS operates and is effective, so every row needs a record (dated,
  attributable), not only a document that says what should happen.
- Related templates: `isms/control-evidence-matrix` (the permanent
  control-to-evidence map this index draws from),
  `isms/certification-findings-action-plan`, `isms/audit-findings-register`,
  `compliance/statement-of-applicability`, `isms/certification-audit-explained`.
-->

## Document control

<!-- Guidance: The index is Confidential: it shows where sensitive evidence sits. Keep it in the ISMS document store with restricted access, and share only extracts with the CB. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-092 |
| Version | [1.0] |
| Status | [Draft / In review / In use during audit / Final] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@ceo] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; CB rules ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 |
| Certification body and audit team | [CB name], lead auditor [name], auditors [names], technical expert [name or none] |
| Audit dates and mode | [YYYY-MM-DD to YYYY-MM-DD, on site / remote / mixed] |
| SoA version audited | DOC-ISMS-011, version [n] |
| Evidence period | [YYYY-MM-DD to YYYY-MM-DD] |
| Next scheduled review | [Before first surveillance audit, YYYY-MM-DD] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Index complete] | YYYY-MM-DD |
| Top management | [@ceo] | [Ready for Stage 2] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 *(Example)* | 2027-04-19 | [@isms-manager] | Clause and Annex A index built from DOC-ISMS-033 |
| 1.0 *(Example)* | 2027-05-07 | [@isms-manager] | Populations refreshed to 2027-05-07, interview schedule confirmed |
| 1.1 *(Example)* | 2027-05-12 | [@isms-manager] | Debrief log and closing meeting notes added |

## Contents

1. Purpose and how to use
2. Audit team, roles and evidence flow
3. Audit room and remote evidence rules
4. Evidence index by clause
5. Evidence index by Annex A theme
6. Sampling readiness
7. Interview schedule
8. Daily debrief log
9. Findings raised during the audit
10. Closing meeting notes
11. Size tiers
12. Records and evidence
13. References

## 1. Purpose and how to use

<!-- Guidance: Say what Stage 2 checks and how this index helps. Questions to answer: what period of operation does the evidence cover, and does every applicable SoA control have at least one record? Pitfall: an index built once and not refreshed, so links point to old versions when the auditor asks. -->

Stage 2 evaluates the implementation and effectiveness of the ISMS: that
the processes in clauses 4 to 10 run as documented, that the applicable
controls in the Statement of Applicability operate, and that the ISMS
achieves its objectives. The audit team follows its own audit plan and
samples records; this index lets the audit guide find any piece of
evidence within minutes and shows the team exactly what was shown.

How to use it:

1. Build sections 4 and 5 from DOC-ISMS-033 (control evidence matrix) and
   check each link opens the current record.
2. Refresh section 6 populations to a cut-off date shortly before Stage 2.
3. Confirm section 7 with every interviewee and a deputy.
4. During the audit, log each request and what was shown (section 2 flow),
   and fill section 8 at the end of each day.
5. After the closing meeting, move findings to
   `isms/certification-findings-action-plan` and keep this file as the
   audit record.

## 2. Audit team, roles and evidence flow

<!-- Guidance: Assign clear roles on your side. One audit guide speaks for the organization in each session; an evidence runner fetches records; a scribe logs requests and what was shown. Pitfall: several people answering at once, or showing more than was asked, which widens the sample. -->

| Role | Name | Responsibility |
|---|---|---|
| Audit guide | [@isms-manager] | Accompanies the audit team, introduces interviewees, keeps time |
| Evidence runner | [@name] | Retrieves records from systems and the document store |
| Scribe | [@name] | Logs each request, the evidence shown and any open request in the request log |
| Process owners | [@owners] | Answer questions on their process and show records |
| Top management representative | [@ceo] | Leadership interview, opening and closing meetings |

```mermaid
sequenceDiagram
  participant AU as Auditor
  participant GD as Audit guide
  participant RN as Evidence runner
  participant OW as Process owner
  participant SC as Scribe
  AU->>GD: Request evidence for a clause or control
  GD->>SC: Log request with time and reference
  GD->>RN: Ask for the record from the index
  RN->>OW: Retrieve record from the system
  OW-->>RN: Record or screen share
  RN-->>GD: Evidence ready
  GD-->>AU: Show evidence
  SC->>SC: Log what was shown and any follow-up
```

Request log format:

| Req ID | Time | Auditor | Request | Clause or control | Evidence shown | Shown by | Open follow-up |
|---|---|---|---|---|---|---|---|
| REQ-001 *(Example)* | 2027-05-10 10:40 | Lead auditor | Last access review of production cloud accounts | A.5.18, A.8.2 | Q2 access review record, 3 removals with tickets | [@head-of-engineering-ops] | None |
| REQ-002 *(Example)* | 2027-05-10 11:15 | Lead auditor | Training record for two persons flagged at Stage 1 | 7.3 | Completion records dated 2027-05-03 | [@hr-lead] | None |
| [REQ-NNN] | [time] | [auditor] | [request] | [ref] | [record] | [@name] | [follow-up] |

## 3. Audit room and remote evidence rules

<!-- Guidance: Agree these rules with the CB before the audit and brief your team. They protect confidential information while giving the auditor real evidence. IAF MD 4:2025, now re-issued by Global ACI as Global ACI-TECH-3-003 (check the current issue), governs the CB's use of remote techniques. Pitfall: sending bulk exports or personal data by e-mail because it is quicker. -->

**On-site audit room**

- Room booked for all audit days, with a screen, power and guest network
  only; no access to internal networks for auditor devices.
- Visitors signed in, badged and escorted outside the audit room
  (DOC-ISMS-055 physical security policy).
- A clean desk in the room: only the evidence being discussed is on the
  table or the screen (DOC-ISMS-056).
- Printed evidence is collected and shredded at the end of each day,
  unless the auditor needs a copy under the CB's confidentiality terms.

**Remote evidence**

- Show evidence by screen share from the live system or the document
  store by default.
- Files are shared only when the auditor needs a copy for the audit file,
  through the channel agreed in the CB contract, under DOC-ISMS-043
  (information transfer policy).
- Personal data, secrets, full vulnerability details and customer data are
  shown, not sent; redact where a copy is unavoidable.
- No recording of sessions unless both parties agree in writing.
- Confirm the identity of every participant at the start of each call.

| Evidence class | Show on screen | Provide a copy | Condition |
|---|---|---|---|
| Policies and procedures | Yes | Yes | Read-only export with version |
| Records with no personal data (for example change tickets) | Yes | On request | Through agreed channel |
| Records with personal data (for example HR screening) | Yes | No | Show a sample, no copies |
| Security configuration and vulnerability data | Yes | No | Show live or redacted |
| Customer contracts | Extracts only | No | Commercial terms hidden |

## 4. Evidence index by clause

<!-- Guidance: One row per clause or sub-clause. "Evidence" means records that show the requirement operates. Keep links to the exact version. The "what the auditor checks" column is our own summary of typical audit focus, not the standard's wording. Auditor check: traceability from context to risk to SoA to objectives to monitoring and review. -->

| Clause | What the auditor typically checks | Evidence (record, ID, location) | Owner | Status |
|---|---|---|---|---|
| 4.1 | Internal and external issues identified, including the climate change decision (Amd 1:2024) | DOC-ISMS-003, steering minute approving it | [@isms-manager] | [Ready / Gap] |
| 4.2 | Interested parties and their relevant requirements, including any climate-related ones | DOC-ISMS-003, DOC-ISMS-014 | [@isms-manager] | [Ready / Gap] |
| 4.3 | Scope boundaries, interfaces and dependencies match reality | DOC-ISMS-002, network and cloud diagrams | [@isms-manager] | [Ready / Gap] |
| 4.4 | ISMS processes and their interactions established | DOC-ISMS-004 process map | [@isms-manager] | [Ready / Gap] |
| 5.1 | Top management leadership shown in practice | Steering committee minutes (DOC-ISMS-007), budget approval, interview | [@ceo] | [Ready / Gap] |
| 5.2 | Policy approved, communicated and available | DOC-ISMS-001, communication record, intranet page | [@ceo] | [Ready / Gap] |
| 5.3 | Roles and authorities assigned and communicated | DOC-ISMS-006, appointment records | [@ceo] | [Ready / Gap] |
| 6.1.1 | Risks and opportunities for the ISMS considered | DOC-ISMS-017 | [@isms-manager] | [Ready / Gap] |
| 6.1.2 | Risk assessment performed with defined criteria, repeatable results | DOC-ISMS-010, DOC-ISMS-015, DOC-ISMS-016 | [@isms-manager] | [Ready / Gap] |
| 6.1.3 | Treatment selected, SoA justified, plan approved, residual risk accepted by risk owners | DOC-ISMS-011, DOC-ISMS-013, DOC-ISMS-019 | Risk owners | [Ready / Gap] |
| 6.2 | Objectives measurable, planned, monitored | DOC-ISMS-024, measurement results | [@ciso] | [Ready / Gap] |
| 6.3 | Changes to the ISMS planned | DOC-ISMS-025 change plan, change records | [@isms-manager] | [Ready / Gap] |
| 7.1 | Resources provided | DOC-ISMS-031 budget and resource plan | [@cfo] | [Ready / Gap] |
| 7.2 | Competence determined and evidenced | DOC-ISMS-026, certificates, training records | [@hr-lead] | [Ready / Gap] |
| 7.3 | Awareness of policy, contribution and consequences | Awareness completion records, interviews with staff | [@hr-lead] | [Ready / Gap] |
| 7.4 | Communication planned and done | DOC-ISMS-027, communication log | [@isms-manager] | [Ready / Gap] |
| 7.5 | Documented information controlled | DOC-ISMS-028, version history samples | [@isms-manager] | [Ready / Gap] |
| 8.1 | Processes planned and controlled, outsourced processes controlled | DOC-ISMS-032 calendar, operating procedures, supplier reviews | [@isms-manager] | [Ready / Gap] |
| 8.2 | Risk assessments at planned intervals and on change | Dated risk assessment results | [@isms-manager] | [Ready / Gap] |
| 8.3 | Risk treatment plan implemented | DOC-ISMS-013 status with completed actions | Risk owners | [Ready / Gap] |
| 9.1 | Monitoring and measurement results analysed | DOC-ISMS-080, DOC-ISMS-081 | [@isms-manager] | [Ready / Gap] |
| 9.2 | Internal audit programme run by objective, competent auditors | DOC-ISMS-082, DOC-ISMS-084, auditor competence | [@internal-auditor] | [Ready / Gap] |
| 9.3 | Management review covers all inputs and records decisions | DOC-ISMS-085 | [@ceo] | [Ready / Gap] |
| 10.1 | Continual improvement shown | DOC-ISMS-088 continual improvement register | [@isms-manager] | [Ready / Gap] |
| 10.2 | Nonconformities handled, root cause, effectiveness checked | DOC-ISMS-087, DOC-ISMS-086 | [@isms-manager] | [Ready / Gap] |

## 5. Evidence index by Annex A theme

<!-- Guidance: Group applicable controls by topic and list the records that prove each group operates. Use the SoA for the full list of 93 controls and their decisions; do not index excluded controls except to show the exclusion reason. Labels are short descriptions written for this library, not official control titles. Pitfall: one screenshot as evidence for a control that should run all year; show records across the evidence period. -->

### 5.1 A.5 Organizational controls (37)

| Controls | Topic | Evidence (record, ID, location) | Owner | Status |
|---|---|---|---|---|
| A.5.1 to A.5.4 | Policies, roles, segregation of duties, management responsibility | DOC-ISMS-005 policy index with review dates, DOC-ISMS-006 | [@ciso] | [Ready / Gap] |
| A.5.5, A.5.6 | Contacts with authorities and special interest groups | DOC-ISMS-069 | [@ciso] | [Ready / Gap] |
| A.5.7 | Threat intelligence (new in 2022) | DOC-ISMS-045, monthly triage log | [@security-lead] | [Ready / Gap] |
| A.5.8 | Security in projects | DOC-ISMS-046 completed checklists for sampled projects | [@pmo-lead] | [Ready / Gap] |
| A.5.9 to A.5.14 | Assets, acceptable use, return, classification, labelling, transfer | DOC-ISMS-012, DOC-ISMS-040, DOC-ISMS-042, DOC-ISMS-043, leaver asset returns | [@it-lead] | [Ready / Gap] |
| A.5.15 to A.5.18 | Access rules, identities, authentication, access rights | DOC-ISMS-041, joiner and leaver tickets, quarterly access reviews | [@it-lead] | [Ready / Gap] |
| A.5.19 to A.5.23 | Suppliers, agreements, ICT supply chain, monitoring, cloud services (A.5.23 new in 2022) | DOC-ISMS-066, DOC-ISMS-067 assessments, DOC-ISMS-068, DOC-ISMS-044 | [@procurement-lead] | [Ready / Gap] |
| A.5.24 to A.5.28 | Incident management and evidence | DOC-ISMS-020, DOC-ISMS-021 entries, DOC-ISMS-022 reviews | [@security-lead] | [Ready / Gap] |
| A.5.29, A.5.30 | Security during disruption, ICT readiness (A.5.30 new in 2022) | DOC-ISMS-121, DOC-ISMS-047, DR test report | [@head-of-engineering-ops] | [Ready / Gap] |
| A.5.31 to A.5.34 | Legal requirements, intellectual property, records, privacy | DOC-ISMS-014, licence inventory, retention schedule, records of processing | [@legal-lead], [@dpo] | [Ready / Gap] |
| A.5.35 to A.5.37 | Independent review, compliance checks, operating procedures | DOC-ISMS-048, compliance check records, DOC-ISMS-049 | [@isms-manager] | [Ready / Gap] |

### 5.2 A.6 People controls (8)

| Controls | Topic | Evidence | Owner | Status |
|---|---|---|---|---|
| A.6.1, A.6.2 | Screening and employment terms | DOC-ISMS-050, sample of screening records (shown, not copied), contract template | [@hr-lead] | [Ready / Gap] |
| A.6.3 | Awareness and training | Training completion report for the evidence period | [@hr-lead] | [Ready / Gap] |
| A.6.4, A.6.5 | Disciplinary process, duties after leaving | DOC-ISMS-052, DOC-ISMS-053 completed checklists | [@hr-lead] | [Ready / Gap] |
| A.6.6 | Confidentiality agreements | DOC-ISMS-051 signed samples | [@legal-lead] | [Ready / Gap] |
| A.6.7 | Remote working | DOC-ISMS-054, device compliance report | [@it-lead] | [Ready / Gap] |
| A.6.8 | Event reporting | DOC-ISMS-023, reports received in the incident register | [@security-lead] | [Ready / Gap] |

### 5.3 A.7 Physical controls (14)

| Controls | Topic | Evidence | Owner | Status |
|---|---|---|---|---|
| A.7.1 to A.7.6 | Perimeters, entry, secure areas, monitoring (A.7.4 new in 2022), environmental threats | DOC-ISMS-055, badge access logs, visitor log, colocation provider assurance (DOC-ISMS-079) | [@facilities-lead] | [Ready / Gap] |
| A.7.7 | Clear desk and clear screen | DOC-ISMS-056, walk-round check records | [@facilities-lead] | [Ready / Gap] |
| A.7.8 to A.7.13 | Equipment, off-site assets, media, utilities, cabling, maintenance | Asset records, maintenance logs, cloud provider assurance for hosted equipment | [@it-lead] | [Ready / Gap] |
| A.7.14 | Disposal and reuse | DOC-ISMS-057 disposal records and certificates | [@it-lead] | [Ready / Gap] |

### 5.4 A.8 Technological controls (34)

| Controls | Topic | Evidence | Owner | Status |
|---|---|---|---|---|
| A.8.1 | Endpoint devices | DOC-ISMS-058, MDM compliance report | [@it-lead] | [Ready / Gap] |
| A.8.2 to A.8.5 | Privileged access, access restriction, source code access, authentication | Privileged account list and review, MFA coverage report, repository permissions | [@head-of-engineering-ops] | [Ready / Gap] |
| A.8.6 | Capacity | Capacity reviews, monitoring dashboards | [@head-of-engineering-ops] | [Ready / Gap] |
| A.8.7, A.8.8 | Malware, vulnerabilities | DOC-ISMS-059, EDR coverage report, DOC-ISMS-072 remediation tracker with SLA results | [@security-lead] | [Ready / Gap] |
| A.8.9 to A.8.12 | Configuration, deletion, masking, leakage prevention (all new in 2022) | DOC-ISMS-060 baseline with drift report, deletion records, DOC-ISMS-062 | [@security-lead] | [Ready / Gap] |
| A.8.13, A.8.14 | Backup, redundancy | DOC-ISMS-061, DOC-ISMS-071 restore test log, region failover test | [@head-of-engineering-ops] | [Ready / Gap] |
| A.8.15 to A.8.17 | Logging, monitoring (A.8.16 new in 2022), clock synchronisation | Logging standard, DOC-ISMS-064 alert triage records, time source configuration | [@security-lead] | [Ready / Gap] |
| A.8.18, A.8.19 | Privileged utilities, software installation | Allow-list configuration, change records | [@it-lead] | [Ready / Gap] |
| A.8.20 to A.8.23 | Network security, network services, segregation, web filtering (A.8.23 new in 2022) | DOC-ISMS-063, firewall rule review, filtering policy report | [@head-of-engineering-ops] | [Ready / Gap] |
| A.8.24 | Cryptography | Cryptography standard, DOC-ISMS-070 key register | [@security-lead] | [Ready / Gap] |
| A.8.25 to A.8.31 | Secure development, requirements, architecture, secure coding (A.8.28 new in 2022), testing, outsourced development, environment separation | DOC-ISMS-065, pull request reviews, SAST and dependency scan results, DOC-ISMS-077 | [@engineering-lead] | [Ready / Gap] |
| A.8.32 | Change management | Sample of change tickets with approvals | [@head-of-engineering-ops] | [Ready / Gap] |
| A.8.33, A.8.34 | Test information, protection during audit testing | Test data rules, approval for any audit testing on production | [@engineering-lead] | [Ready / Gap] |

## 6. Sampling readiness

<!-- Guidance: Auditors pick samples from complete populations. Prepare each population as a list with the fields shown, for the whole evidence period, and be ready to retrieve any item. Do not pre-select samples for the auditor. Pitfall: a population list that is incomplete (for example missing contractors), which undermines every sample taken from it. -->

Example populations *(Example: Quillmere Analytics Ltd, evidence period
2027-01-04 to 2027-05-07; leavers over the 12 months to 2027-05-07)*:

| Pop ID | Population | Source system | Fields in the list | Count *(Example)* | Ready |
|---|---|---|---|---|---|
| POP-01 | Joiners (employees and contractors) | HR system, supplier register | Name, start date, role, screening date, NDA date, training date | 9 | [Yes / No] |
| POP-02 | Leavers (12 months) | HR system | Name, end date, account disable date per system, asset return date | 11 | [Yes / No] |
| POP-03 | Role changes | HR system | Name, date, old role, new role, access change ticket | 3 | [Yes / No] |
| POP-04 | Production changes | Change and deployment tool | ID, date, approver, test evidence, rollback plan | 186 | [Yes / No] |
| POP-05 | Security events and incidents | DOC-ISMS-021 | ID, date, severity, status, closure date | 13 | [Yes / No] |
| POP-06 | Vulnerabilities rated high or critical | DOC-ISMS-072 | ID, discovered, fixed, SLA met | 27 | [Yes / No] |
| POP-07 | Privileged accounts | Identity provider, cloud console | Account, owner, last review | 14 | [Yes / No] |
| POP-08 | Critical suppliers | DOC-ISMS-066 | Supplier, service, last assessment, contract clauses | 9 | [Yes / No] |
| POP-09 | Backup restore tests | DOC-ISMS-071 | Date, system, result, time to restore | 6 | [Yes / No] |
| POP-10 | Endpoint devices | MDM | Device, owner, encryption, OS version, compliance state | 52 | [Yes / No] |

Consistency checks before the audit:

- POP-01 joiners plus existing staff minus POP-02 leavers equals the
  current scope headcount (46 persons: 38 employees, 8 contractors).
- Every POP-05 incident has a matching entry in DOC-ISMS-022 where a
  post-incident review was required.
- Every POP-06 item has a fix date or an approved exception
  (`security/security-exception-request`).

## 7. Interview schedule

<!-- Guidance: Confirm slots with each interviewee and a named deputy. Brief interviewees: answer what is asked, show records, say "I will find out" rather than guess. The CB's audit plan is the authority; adjust this table when it arrives. -->

Example schedule *(Example: Quillmere Analytics Ltd, Stage 2 of 3.5 audit
days over three calendar days, 2027-05-10 to 2027-05-12; a second
auditor joins for half a day on day 2)*:

| Day and time | Session | Interviewee | Deputy | Clauses and controls |
|---|---|---|---|---|
| Day 1, 09:00 | Opening meeting | [@ceo], [@isms-manager] | [@ciso] | Audit plan, scope confirmation |
| Day 1, 09:45 | Leadership, context, policy | [@ceo] | [@coo] | 4.1 to 5.3 |
| Day 1, 11:00 | Risk assessment and treatment | [@isms-manager] | [@coo] | 6.1, 8.2, 8.3, SoA |
| Day 1, 14:00 | Objectives, measurement, resources | [@isms-manager] | [@cfo] | 6.2, 7.1, 9.1 |
| Day 2, 09:00 | People controls and HR | [@hr-lead] | [@coo] | 7.2, 7.3, A.6 |
| Day 2, 11:00 | Access, identities, endpoints | [@it-lead] | [@head-of-engineering-ops] | A.5.15 to A.5.18, A.8.1 to A.8.5 |
| Day 2, 14:00 | Cloud operations, backup, logging | [@head-of-engineering-ops] | [@engineering-lead] | A.5.23, A.8.13 to A.8.17 |
| Day 2, 14:00 (second auditor) | Secure development and change | [@engineering-lead] | [@head-of-engineering-ops] | A.8.25 to A.8.32 |
| Day 2, 16:00 | Office walk-round | [@facilities-lead] | [@isms-manager] | A.7 |
| Day 3, 09:00 | Suppliers and legal | [@procurement-lead], [@legal-lead] | [@coo] | A.5.19 to A.5.22, A.5.31 to A.5.34 |
| Day 3, 10:15 | Incidents, continuity, threat intelligence | [@security-lead] | [@isms-manager] | A.5.7, A.5.24 to A.5.30 |
| Day 3, 11:30 | Internal audit, management review, improvement | [@internal-auditor], [@ceo] | [@isms-manager] | 9.2, 9.3, 10 |
| Day 3, 13:30 | Auditor preparation time | None | None | CB internal review |
| Day 3, 15:00 | Closing meeting | [@ceo], [@isms-manager], process owners | [@ciso] | Findings, recommendation, next steps |

## 8. Daily debrief log

<!-- Guidance: Ask the lead auditor for a short debrief at the end of each day. Record potential findings, open requests and actions for the next morning. Pitfall: learning about a potential nonconformity only at the closing meeting, when there is no time to show missing evidence. -->

| Day | Date | Areas covered | Potential findings raised by auditor | Open requests | Our actions overnight | Owner |
|---|---|---|---|---|---|---|
| 1 *(Example)* | 2027-05-10 | 4 to 6, 7.1, 9.1 | One objective has no result for April; no record of risk owner approval of the treatment plan DOC-ISMS-013 or of acceptance for the High residual risks | REQ-007: risk acceptance for R-018 | Retrieve signed acceptance ACC-001 from DOC-ISMS-019, add April result with explanation, collect any approval records | [@isms-manager] |
| 2 *(Example)* | 2027-05-11 | 7.2, 7.3, A.6, A.5.15 to A.5.18, A.8.1 to A.8.5, A.5.23, A.8.13 to A.8.17, A.8.25 to A.8.32, A.7 | 1 of 10 sampled leavers kept access to the support ticketing tool for 9 days (target 1 business day) | None | Prepare root cause and corrective action proposal | [@it-lead] |
| [n] | YYYY-MM-DD | [areas] | [findings] | [REQ-NNN] | [actions] | [@owner] |

## 9. Findings raised during the audit

<!-- Guidance: Record each finding as the CB states it, with its grade. Do not argue grading in the room; ask for the objective evidence and the requirement, and use the CB's appeal route if you disagree. Corrections and corrective actions for nonconformities must be accepted by the CB (and majors verified) before a certification decision. -->

| ID | CB ref | Grade (CB) | Requirement | Finding summary | Objective evidence | Next step |
|---|---|---|---|---|---|---|
| S2F-001 *(Example)* | NC-01 | Major nonconformity | 6.1.3 | No record that risk owners approved the risk treatment plan or accepted residual risks; 14 High risks without acceptance (CBF-2027-01 in DOC-ISMS-093) | DOC-ISMS-013 v0.9 unsigned, DOC-ISMS-016 export | Correction, root cause and corrective action, with implementation verified by the CB before the decision, *Example:* evidence within 90 days as set by the CB |
| S2F-002 *(Example)* | NC-02 | Minor nonconformity | A.5.18 | 1 of 10 sampled leavers kept access to the support ticketing tool for 9 days after the leaving date (CBF-2027-02 in DOC-ISMS-093) | POP-02 sample, ticketing tool audit log | Correction and corrective action plan in `isms/certification-findings-action-plan`, *Example:* submitted to CB within the period the CB sets (for example 30 days) |
| S2F-003 to S2F-008 *(Example)* | NC-03, NC-04, OFI-01 to OFI-04 | 2 minor nonconformities, 4 opportunities for improvement | A.5.19, 7.2, 9.1, A.8.16, A.5.7, 7.4 | See CBF-2027-03 to CBF-2027-08 in DOC-ISMS-093 section 4 | As recorded by the CB | Plans for the minors; decisions recorded for each OFI |
| [S2F-NNN] | [ref] | [grade] | [ref] | [summary] | [evidence] | [step] |

## 10. Closing meeting notes

<!-- Guidance: Record what the CB said, not what you hoped. The audit team recommends; the CB's certification function decides after reviewing the report and your responses. -->

| Field | Value |
|---|---|
| Date and time | [YYYY-MM-DD hh:mm] |
| Attendees | [names and roles] |
| Scope confirmed | [Yes / No, with changes] |
| Sampling statement by CB | [The audit was based on samples; findings may exist that were not found] |
| Findings presented | *Example:* 1 major, 3 minor, 4 opportunities for improvement |
| Deadlines stated by CB | *Example:* correction and corrective action plan for all nonconformities within 30 days (2027-06-11) and evidence for the major NC-01 within 90 days (2027-08-10), as set by the CB |
| Audit team recommendation | [Recommended for certification subject to acceptance of corrective action plans / Not recommended / Follow-up visit needed] |
| Expected certification decision and certificate date | [as stated by the CB] |
| First surveillance audit | No later than 12 months from the certification decision date; *Example:* planned for [month] |
| Questions raised by us and answers | [notes] |
| Actions for us | Transfer findings to DOC-ISMS-093, brief top management, update DOC-ISMS-094 certification cycle plan |

## 11. Size tiers

<!-- Guidance: The structure of Stage 2 is the same at every size. What changes is the number of auditors and sites, how many populations exist, and how you coordinate evidence. These are the library's working tiers, not official definitions. -->

| Aspect | Small: Quillmere Analytics Ltd *(Example)* | Medium: Quillmere Health Systems *(Example)* | Large: Quillmere Group *(Example)* |
|---|---|---|---|
| Profile | 46 persons, one office plus remote staff, one cloud provider in two regions | 320 staff, two offices, one colocation suite | 2,400 staff, 6 sites in 4 countries, OT and IT, ISO 9001 and ISO 22301 certified |
| Audit team | One lead auditor | Lead auditor plus one auditor, possibly a health-sector technical expert | Several auditors in parallel tracks, site visits by sample under ISO/IEC 27006-1 and IAF MD 1:2023 (Global ACI-TECH-3-001) |
| Evidence coordination | ISMS manager (0.5 FTE) as guide, one runner | ISMS manager as guide, security team as runners, one scribe | Central evidence desk in the CISO office, site coordinators, shared request log across sites |
| Populations | About 10, small counts | About 15, including colocation access and clinical customer contracts | Per site and per function, including OT change and remote access populations |
| Audit room | Remote with office walk-round | One office as audit base, visit to the colocation suite | Audit room at each visited site, daily cross-site debrief |
| Integrated audit | None | ISO/IEC 27701:2025 extension planned for next year | Combined with ISO 9001 and ISO 22301 under IAF MD 11:2023 (Global ACI-TECH-3-008) if the CB agrees |

## 12. Records and evidence

<!-- Guidance: This file, the request log, the CB audit plan and the CB report together are the record of the Stage 2 audit. Keep them for the whole certification cycle so surveillance auditors can see what was shown before. -->

| Record | Owner | Location | Retention |
|---|---|---|---|
| This evidence index, final version | [@isms-manager] | [ISMS document store, restricted] | Certification cycle + 3 years *(Example)* |
| Request log (section 2) | Scribe | [ISMS document store, restricted] | Certification cycle + 3 years |
| Copies given to the CB, with redaction notes | [@isms-manager] | [ISMS document store, restricted] | Certification cycle + 3 years |
| Daily debrief log and closing meeting notes | [@isms-manager] | [ISMS document store] | Certification cycle + 3 years |
| CB audit plan and audit report | [@isms-manager] | [ISMS document store] | Certification cycle + 3 years |
| Findings and corrective action records | [@isms-manager] | DOC-ISMS-093, DOC-ISMS-086, DOC-ISMS-087 | Certification cycle + 3 years |

Keep the permanent control-to-evidence links in `isms/control-evidence-matrix`
(DOC-ISMS-033) and register these records in DOC-ISMS-028.

## 13. References

<!-- Guidance: Cite editions exactly. The CB's audit plan and report are the binding description of your audit. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 (https://www.iso.org/standard/82875.html) | 2022 | Clauses 4 to 10 and Annex A |
| ISO/IEC 27001:2022/Amd 1:2024 (https://www.iso.org/standard/88435.html) | 2024-02-23 | Climate change in 4.1 and 4.2 |
| ISO/IEC 27002:2022 (https://www.iso.org/standard/75652.html) | 2022 | Control guidance |
| ISO/IEC 17021-1:2015 (https://www.iso.org/standard/61651.html) | 2015 | Stage 2, findings, certification decision |
| ISO/IEC 27006-1:2024 (https://www.iso.org/standard/82908.html) | 2024 | ISMS audit requirements, multi-site |
| ISO/IEC 27007:2020 (https://www.iso.org/standard/77802.html) | 2020, under revision | ISMS auditing guidance |
| ISO 19011:2026 (https://www.iso.org/standard/88984.html) | 2026 | Auditing management systems |
| IAF MD 1:2023 and IAF MD 4:2025, re-issued as Global ACI-TECH-3-001 and Global ACI-TECH-3-003 | Issue 3 each; Global ACI v1.0 in force 28 Aug 2026 (check the current issue) | Multi-site sampling, remote audit techniques |

Related templates: `isms/stage-1-readiness-pack`,
`isms/certification-findings-action-plan`, `isms/certification-cycle-plan`,
`isms/control-evidence-matrix`, `isms/audit-findings-register`,
`isms/surveillance-readiness-health-check`, `compliance/statement-of-applicability`,
`compliance/capa-nonconformity`, `isms/certification-audit-explained`.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 4 to 10
and Annex A themes) and with the Stage 2 requirements for certification
bodies in ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. The index, audit
focus summaries, rules and examples are original; control labels are short
descriptions written for this library, and no ISO/IEC text is reproduced.
ISO and IEC standards are copyrighted: obtain the official text from ISO
(https://www.iso.org/standard/82875.html) or your national standards body.
Check the current editions and your certification body's audit plan and
rules before use. Using this index does not guarantee certification; the
certification decision belongs to the certification body. Template
licence: MIT.