How do we run an internal audit when we are small?

Start

We need an internal audit, and have few people to do it

Before the first certification, one full audit cycle must be completed and reported, with its nonconformities in corrective action, before the Stage 2 audit. Size makes the programme shorter, not optional. The hard part in a small organisation is independence, not effort.

• Then: Write a one-page programme that covers the whole ISMS

Step

Write a one-page programme that covers the whole ISMS

Cover every management-system clause and every applicable Annex A control. Group them into audits of requirements run by the same people, so the auditor can follow one thread from a risk to its control to the records. The pack suggests a first cycle of four or five one-day audits for a small organisation, finishing before the Stage 1 audit.

• Then: Does the ISMS manager run or write this area?

Decision

Does the ISMS manager run or write this area?

Nobody audits a process they run, manage or wrote the procedure for, or a control their own team operates. The ISMS manager manages the programme but runs the management-system clauses, so cannot audit them. If you are not sure who wrote the procedure, treat the answer as yes.

• Yes, or not known: Use a contracted auditor who did not help build it
• No: Is there a manager from another team who does not run it?

Decision

Is there a manager from another team who does not run it?

A manager from finance or engineering who asks 'show me' and waits for the record often finds more than a security specialist. They may audit controls their own team does not operate. The pack's example trains an engineering lead who may not audit technology controls, and a finance manager who may not audit finance systems.

• Yes: Train them as an internal auditor for this area
• No: Could you swap audits with a peer from another small firm?

Step

Train them as an internal auditor for this area

Record what they may not audit, and have them sign an independence statement in each audit plan. Training one or two managers from other teams gives you in-house auditors for most of the Annex A controls.

• Then: Does the auditor meet the competence requirements?

Decision

Could you swap audits with a peer from another small firm?

Two small organisations can audit each other's controls, under a confidentiality agreement. Each auditor still needs the competence the procedure sets, and must not have advised on what they audit.

• Yes: Agree the swap under a confidentiality agreement
• No: Use a contracted auditor who did not help build it

Step

Agree the swap under a confidentiality agreement

Put the arrangement and the confidentiality agreement on record, and name the peer auditor in the audit plan with their independence statement. Keep their qualification with the programme.

• Then: Does the auditor meet the competence requirements?

Step

Use a contracted auditor who did not help build it

This is the usual answer for the parts the ISMS manager runs. Keep a copy of the auditor's qualification, their engagement letter, and a statement that they have not advised on, designed or run what they audit. A consultant who helped build the ISMS may not audit what they built.

• Then: Has the executive sponsor approved the auditor's time or fee?

Decision

Has the executive sponsor approved the auditor's time or fee?

The executive sponsor approves the programme and its resources: auditors' time, any contracted auditor, and the auditees' time. Get the approval before the first audit notice goes out.

• Yes: Does the auditor meet the competence requirements?
• No: Escalate: no independent auditor is available

Outcome

Escalate: no independent auditor is available

The ISMS manager takes it to the executive sponsor. An internal audit done by the person who runs the ISMS is one of the common first-certification failures, and the certification body checks for it at Stage 1.

Decision

Does the auditor meet the competence requirements?

They know the standard, through an internal auditor course or a lead auditor qualification. They know how to audit, having shadowed an audit before leading one. They know enough of the area to ask the right question, or audit with someone who does. If you have no record of it, treat the answer as no.

• Yes: Plan it, then ask to be shown, and choose the samples
• No, or no record: Train them, and have them shadow an audit first

Step

Train them, and have them shadow an audit first

Keep the course record, the record of the shadowed audit and their first report, reviewed. These are the competence evidence the certification body will ask for.

• Then: Plan it, then ask to be shown, and choose the samples

Step

Plan it, then ask to be shown, and choose the samples

Send the plan at least 10 working days ahead in the pack's default. On the day, ask people to show the record, the ticket or the screen rather than describe it. The auditor, not the auditee, picks the samples from the whole period. If the first samples fail, take more to see whether it is isolated or systematic.

• Then: What is the worst finding?

Decision

What is the worst finding?

Grade by effect, not by embarrassment. A major nonconformity means a requirement is not met at all, or a failure is widespread or repeated. A minor one is an isolated lapse in a system that still works. An observation breaks no requirement. When in doubt between major and minor, take more samples.

• Major nonconformity: Tell the executive sponsor at once
• Minor nonconformity: Fix it, find the root cause, and check the fix worked
• Observations, or none: Report each audit, then summarise the cycle

Step

Tell the executive sponsor at once

In the pack's defaults the sponsor hears within 2 working days of the closing meeting at the latest. Treat every internal major as a blocker: a certification body finding the same would normally stop or delay the certificate.

• Then: Fix it, find the root cause, and check the fix worked

Step

Fix it, find the root cause, and check the fix worked

The control owner makes the correction, finds a root cause the organisation can change and plans a corrective action. 'Human error' is never a root cause on its own. The auditor then takes new samples to confirm the cause is gone. Never close a finding on the owner's word alone.

• Then: Report each audit, then summarise the cycle

Step

Report each audit, then summarise the cycle

Each report states the scope, the samples tested, the findings and a conclusion. If every sample passed, say so: it is evidence too. The cycle summary covers audits done against plan, findings by grade, open actions and the weakest areas. Have someone who did not carry out the audits check the programme itself.

• Then: Will the first full cycle finish before the Stage 1 audit?

Decision

Will the first full cycle finish before the Stage 1 audit?

The certification body wants to see a complete programme at Stage 1, and the management review needs its results. The latest acceptable point is before Stage 2. If you do not know, treat the answer as no.

• Yes: Cycle complete: the summary goes to the management review
• No, or not known: Propose moving Stage 1 or re-planning the audits

Outcome

Propose moving Stage 1 or re-planning the audits

The ISMS manager takes it to the executive sponsor and top management, with a proposal to move the Stage 1 date or re-plan the programme. An internal audit left until the last week leaves no time to correct what it found.

Outcome

Cycle complete: the summary goes to the management review

The programme summary is an input to the management review. After the review, update the programme: areas with a major finding or incident move to yearly, clean areas drop back. After certification, everything is audited once in each cycle, which is 3 years in the pack's default.