Skip to content

Procedure for Internal Audits

Purpose. Defines how Soon plans and conducts internal audits of the ISMS to confirm it conforms to ISO/IEC 27001:2022 and is effectively implemented and maintained (clause 9.2, control A.5.35). Internal audit is a mandatory requirement and an ISO Stage 1/Stage 2 checkpoint.

1. Principles

  • Independence/objectivity — auditors must not audit their own work. At Soon, the ISM (Olaf) runs the ISMS, so internal audits are performed by the external consultant Andrea (CyberSquad) to preserve independence. Confirmed — Andrea runs the internal audit and is not involved in operating the controls he audits.
  • Risk- and priority-based — coverage focuses on higher-risk areas first.
  • Evidence-based — findings are supported by objective evidence.

2. Audit programme (9.2.2)

  • An audit programme (ISMS-FORM-09-1) defines the schedule, scope and frequency.
  • Over a 3-year certification cycle, all clauses (4–10) and all applicable Annex A controls must be audited at least once; high-risk areas more often.
  • Baseline cadence: at least one full internal audit per year, plus targeted audits after major change or incident.

3. Procedure for each audit

  1. Plan — agree scope, criteria (the standard + Soon's ISMS docs), and dates; produce an audit plan.
  2. Conduct — review documents, interview owners, and sample evidence against the Statement of Applicability and procedures. Use an audit checklist (ISMS-FORM-09-4).
  3. Record findings — classify as conformity, nonconformity (major/minor), observation, or opportunity for improvement.
  4. Report — produce an Internal Audit Report (ISMS-DOC-09-5) for management.
  5. Follow up — raise nonconformities into the Nonconformity & Corrective Action process; verify closure at the next audit.

4. Inputs & outputs

Inputs Outputs
ISMS documents, SoA, risk assessment, prior findings, this standard Audit plan, completed checklist, Internal Audit Report, nonconformities raised

5. Roles

  • Auditor (Andrea) — plans and performs audits independently; reports findings.
  • ISM (Olaf) — schedules audits, provides access, owns corrective actions, reports results to management review.
  • Auditees (control/risk owners) — provide evidence and implement corrective actions.

Change log

Version Date Author Comments
0.1 2026-06-25 Andrea Cardinali / ISMS First draft — independent audit by consultant, programme, per-audit steps, finding classes.