Skip to content

Procedure for Internal Audits

Purpose. Defines how Soon plans and conducts internal audits of the ISMS to confirm it conforms to ISO/IEC 27001:2022 and is effectively implemented and maintained (clause 9.2, control A.5.35). Internal audit is a mandatory requirement and an ISO Stage 1/Stage 2 checkpoint.

1. Principles

  • Independence/objectivity — auditors must not audit their own work. At Soon, the Olaf Jacobson (ISM) runs the ISMS, so internal audits are performed by the external consultant Andrea (CyberSquad) to preserve independence. Confirmed — Andrea runs the internal audit and is not involved in operating the controls he audits. He drafted most ISMS documents, so independence rests on two compensating controls: every document he drafted is reviewed and approved by the ISM (Olaf Jacobson) before it takes effect, and his related-party status (brother of the founders) is disclosed here and in ISMS-DOC-05-2 §1.7.
  • Risk- and priority-based — coverage focuses on higher-risk areas first.
  • Evidence-based — findings are supported by objective evidence.

2. Audit programme (9.2.2)

  • An audit programme (ISMS-FORM-09-1) defines the schedule, scope and frequency.
  • Over a 3-year certification cycle, all clauses (4–10) and all applicable Annex A controls must be audited at least once; high-risk areas more often.
  • Baseline cadence: at least one full internal audit per year, plus targeted audits after major change or incident.

3. Procedure for each audit

  1. Plan — agree scope, criteria (the standard + Soon's ISMS docs), and dates; produce an audit plan.
  2. Conduct — review documents, interview owners, and sample evidence against the Statement of Applicability and procedures. Use an audit checklist (ISMS-FORM-09-4).
  3. Record findings — classify as conformity, nonconformity (major/minor), observation, or opportunity for improvement.
  4. Report — produce an Internal Audit Report (ISMS-DOC-09-5) for management.
  5. Follow up — raise nonconformities into the Nonconformity & Corrective Action process; verify closure at the next audit.

4. Inputs & outputs

Inputs Outputs
ISMS documents, SoA, risk assessment, prior findings, this standard Audit plan, completed checklist, Internal Audit Report, nonconformities raised

5. Roles

  • Auditor (Andrea) — plans and performs audits independently; reports findings.
  • Olaf Jacobson (ISM) — schedules audits, provides access, owns corrective actions, reports results to management review.
  • Auditees (control/risk owners) — provide evidence and implement corrective actions.

Change log

Version Date Author Comments
0.1 2026-06-25 Andrea Cardinali / ISMS First draft — independent audit by consultant, programme, per-audit steps, finding classes.