ISO 27001 Internal Auditor cheat sheet

Confidentiality preserves authorized restriction of access; integrity preserves accuracy and completeness; availability ensures accessible and usable on demand by an authorized entity (ISO/IEC 27000 definitions).

Information security is preservation of confidentiality, integrity and availability of information; other properties such as authenticity, accountability, non-repudiation and reliability may also be involved.

Risk is the effect of uncertainty on objectives; information security risk is expressed as a combination of the consequences of an event and its likelihood.

A vulnerability is a weakness that can be exploited by one or more threats; a threat is a potential cause of an unwanted incident; an asset is anything that has value to the organization.

Residual risk is risk remaining after risk treatment; risk acceptance is the informed decision to retain that residual risk.

Defence in depth layers preventive, detective and corrective controls so failure of one layer does not defeat the whole protection scheme.

Least privilege and need-to-know limit access rights to the minimum necessary for assigned duties; separation of duties prevents one person from completing a sensitive process alone.

The CIA triad applies to all forms of information, not only electronic data; paper records, verbal communication and intellectual property are in scope.

Threat, vulnerability, likelihood and impact together drive risk level; a high-impact event with low likelihood may still require treatment.

ISO/IEC 27001 uses the High Level Structure: Clauses 4 Context, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

Clause 4 requires determining external and internal issues, interested parties and their requirements, and defining ISMS scope and boundaries.

Clause 5 requires top management to demonstrate leadership, establish an information security policy, and assign roles, responsibilities and authorities.

Clause 6 requires risk assessment, risk treatment, a Statement of Applicability, and information security objectives with plans to achieve them.

Clause 7 covers resources, competence, awareness, communication and documented information; Clause 8 covers operational planning, risk assessment execution and treatment implementation.

Clause 9 requires monitoring, measurement, analysis, evaluation, internal audit and management review; Clause 10 requires handling nonconformity and continual improvement.

The Statement of Applicability lists all Annex A controls, states inclusion or exclusion, and gives justification for each exclusion.

Annex A in ISO/IEC 27001:2022 has 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34).

The ISMS is a set of interrelated elements including policy, objectives, processes and documented information used to manage information security risk.

Audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria.

Audit criteria are the set of requirements used as a reference against which objective evidence is compared; audit evidence is records, statements of fact or other information relevant to the criteria and verifiable.

Audit findings are results of evaluating collected evidence against criteria; they are classified as conforming or nonconforming, and nonconformities may be graded major or minor.

Independence requires auditors not audit their own work; objectivity requires freedom from bias and conflict of interest.

ISO 19011 distinguishes first-party (internal), second-party (external provider) and third-party (certification/regulatory) audits.

An audit programme is a set of one or more audits planned for a specific time frame and directed towards a specific purpose.

ISO 19011 audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.

Evidence-based approach means evidence shall be verifiable and conclusions shall be reached only on the basis of verified evidence; hearsay alone is insufficient.

The audit approach should be risk-based: allocate more time and depth to processes and controls with higher information security risk and greater importance to the ISMS.

Audit criteria for an internal ISMS audit typically comprise ISO/IEC 27001 requirements, the organization's own ISMS documentation, applicable legal and contractual requirements, and the Statement of Applicability.

Auditing Clause 6.1.2 requires evidence of a defined and applied risk assessment process producing consistent, valid, comparable results and identified risk owners.

Auditing Clause 6.1.3 requires evidence of a risk treatment process selecting controls and producing a Statement of Applicability with justifications.

Auditing Annex A controls verifies implementation and effectiveness; the SoA alone does not prove a control operates.

Audit sampling must be planned and justified; sample size should increase with the size of the population and decrease with the confidence already obtained.

Document review, interviews, observation and technical verification are complementary evidence-gathering techniques; a single technique rarely suffices.

Audit trails should follow the process flow (input, processing, output) and the risk treatment path from risk to control to evidence.

The audit plan defines audit objectives, scope, criteria, dates, locations, audit team, auditees and allocation of time; it is communicated to auditees in advance.

Audit objectives state what the audit is intended to accomplish; scope states the extent and boundaries (units, processes, locations, period).

A document review before fieldwork establishes familiarity with ISMS documentation, prior audit findings, nonconformities and corrective actions.

A checklist or audit guide is a tool to structure questions against criteria; it must not become a rigid script that prevents following audit trails.

The opening meeting confirms the audit plan, scope, criteria, methods, communication channels, confidentiality and escalation routes.

Audit working documents include checklists, sampling plans, forms for recording evidence and findings, and should be retained per programme procedures.

Selection of the audit team considers competence in the audited area, language, independence from the activity being audited and available time.

Feasibility assessment confirms sufficient time, resources and access to information; if not feasible, the audit plan is adjusted before starting.

The opening meeting sets the tone; the closing meeting presents findings and conclusions, and agreement on facts is sought, not necessarily on the audit conclusion.

Interviews should target the person responsible for the process; record date, interviewee, role, questions and evidence references.

Observation of actual practice reveals gaps between documented procedures and real operation, a common source of nonconformity.

A nonconformity statement contains three parts: the requirement (criterion), the evidence found, and the explanation of why it is a nonconformity.

Findings should be traceable to objective evidence; unsupported statements or opinions are not findings.

Auditors should avoid consulting or advising during the audit; the auditor verifies, the auditee decides how to correct.

Sampling during interviews should be random or risk-directed, and the sample should be recorded so the finding can be reproduced.

When a nonconformity is identified, verify whether a related corrective action from a prior audit was effective; recurrence indicates systemic weakness.

The audit report contains audit objectives, scope, criteria, dates, locations, audit team, auditees, findings, conclusions and any deviations from the plan.

Findings are classified as conforming or nonconforming; major nonconformity means the requirement is not addressed or a systemic failure affects the management system's ability to meet requirements.

The report should be factual, clear, complete, timely and accurate; it should not attribute findings to individuals by name.

Corrective action requires root cause analysis, a correction, an action to eliminate the cause, and verification of effectiveness.

The auditee is responsible for deciding and implementing corrective action; the auditor verifies implementation and effectiveness.

Audit closure includes confirming corrective actions are implemented and effective, updating the audit programme, and retaining records.

The report is distributed to the audit client and those entitled to receive it according to the audit programme; confidentiality applies.

Follow-up audits may be scheduled to verify corrective actions; unclosed nonconformities are escalated to management review.

The audit programme is reviewed periodically for effectiveness, and results feed into the management review under Clause 9.3.

Confidentiality preserves authorized restriction of access; integrity preserves accuracy and completeness; availability ensures accessible and usable on demand by an authorized entity.

Information security is preservation of confidentiality, integrity and availability; other properties such as authenticity, accountability, non-repudiation and reliability may also be involved.

Risk is the effect of uncertainty on objectives; information security risk combines the consequences of an event and its likelihood.

A vulnerability is a weakness that can be exploited by one or more threats; a threat is a potential cause of an unwanted incident.

Residual risk is risk remaining after risk treatment; risk acceptance is the informed decision to retain that residual risk.

Defence in depth layers preventive, detective and corrective controls so failure of one layer does not defeat the whole protection scheme.

Least privilege and need-to-know limit access rights to the minimum necessary for assigned duties; separation of duties prevents one person from completing a sensitive process alone.

The CIA triad applies to all forms of information, not only electronic data; paper records, verbal communication and intellectual property are in scope.

Threat, vulnerability, likelihood and impact together drive risk level; a high-impact event with low likelihood may still require treatment.

ISO/IEC 27001 uses the High Level Structure: Clause 4 Context, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

Clause 4 requires determining external and internal issues, interested parties and their requirements, and defining ISMS scope and boundaries.

Clause 5 requires top management to demonstrate leadership, establish an information security policy, and assign roles, responsibilities and authorities.

Clause 6 requires risk assessment, risk treatment, a Statement of Applicability, and information security objectives with plans to achieve them.

Clause 7 covers resources, competence, awareness, communication and documented information; Clause 8 covers operational planning, risk assessment execution and treatment implementation.

Clause 9 requires monitoring, measurement, analysis, evaluation, internal audit and management review; Clause 10 requires handling nonconformity and continual improvement.

The Statement of Applicability lists all Annex A controls, states inclusion or exclusion, and gives justification for each exclusion.

Annex A in ISO/IEC 27001:2022 has 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34).

The ISMS is a set of interrelated elements including policy, objectives, processes and documented information used to manage information security risk.

Audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria.

Audit criteria are the set of requirements used as a reference against which objective evidence is compared; audit evidence is records, statements of fact or other information relevant to the criteria and verifiable.

Audit findings are results of evaluating collected evidence against criteria; they are classified as conforming or nonconforming, and nonconformities may be graded major or minor.

Independence requires auditors not audit their own work; objectivity requires freedom from bias and conflict of interest.

ISO 19011 distinguishes first-party (internal), second-party (external provider) and third-party (certification/regulatory) audits.

An audit programme is a set of one or more audits planned for a specific time frame and directed towards a specific purpose.

ISO 19011 audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.

Evidence-based approach means evidence shall be verifiable and conclusions shall be reached only on the basis of verified evidence; hearsay alone is insufficient.

The audit approach should be risk-based: allocate more time and depth to processes and controls with higher information security risk and greater importance to the ISMS.

Audit criteria for an internal ISMS audit typically comprise ISO/IEC 27001 requirements, the organization's own ISMS documentation, applicable legal and contractual requirements, and the Statement of Applicability.

Auditing Clause 6.1.2 requires evidence of a defined and applied risk assessment process producing consistent, valid, comparable results and identified risk owners.

Auditing Clause 6.1.3 requires evidence of a risk treatment process selecting controls and producing a Statement of Applicability with justifications.

Auditing Annex A controls verifies implementation and effectiveness; the SoA alone does not prove a control operates.

Audit sampling must be planned and justified; sample size should increase with the size of the population and decrease with the confidence already obtained.

Document review, interviews, observation and technical verification are complementary evidence-gathering techniques; a single technique rarely suffices.

Audit trails should follow the process flow (input, processing, output) and the risk treatment path from risk to control to evidence.

The audit plan defines audit objectives, scope, criteria, dates, locations, audit team, auditees and allocation of time; it is communicated to auditees in advance.

Audit objectives state what the audit is intended to accomplish; scope states the extent and boundaries (units, processes, locations, period).

A document review before fieldwork establishes familiarity with ISMS documentation, prior audit findings, nonconformities and corrective actions.

A checklist or audit guide is a tool to structure questions against criteria; it must not become a rigid script that prevents following audit trails.

The opening meeting confirms the audit plan, scope, criteria, methods, communication channels, confidentiality and escalation routes.

Audit working documents include checklists, sampling plans, forms for recording evidence and findings, and should be retained per programme procedures.

Selection of the audit team considers competence in the audited area, language, independence from the activity being audited and available time.

Feasibility assessment confirms sufficient time, resources and access to information; if not feasible, the audit plan is adjusted before starting.

The opening meeting sets the tone; the closing meeting presents findings and conclusions, and agreement on facts is sought, not necessarily on the audit conclusion.

Interviews should target the person responsible for the process; record date, interviewee, role, questions and evidence references.

Observation of actual practice reveals gaps between documented procedures and real operation, a common source of nonconformity.

A nonconformity statement contains three parts: the requirement (criterion), the evidence found, and the explanation of why it is a nonconformity.

Findings should be traceable to objective evidence; unsupported statements or opinions are not findings.

Auditors should avoid consulting or advising during the audit; the auditor verifies, the auditee decides how to correct.

Sampling during interviews should be random or risk-directed, and the sample should be recorded so the finding can be reproduced.

When a nonconformity is identified, verify whether a related corrective action from a prior audit was effective; recurrence indicates systemic weakness.

The audit report contains audit objectives, scope, criteria, dates, locations, audit team, auditees, findings, conclusions and any deviations from the plan.

Findings are classified as conforming or nonconforming; major nonconformity means the requirement is not addressed or a systemic failure affects the management system's ability to meet requirements.

The report should be factual, clear, complete, timely and accurate; it should not attribute findings to individuals by name.

Corrective action requires root cause analysis, a correction, an action to eliminate the cause, and verification of effectiveness.

The auditee is responsible for deciding and implementing corrective action; the auditor verifies implementation and effectiveness.

Audit closure includes confirming corrective actions are implemented and effective, updating the audit programme, and retaining records.

The report is distributed to the audit client and those entitled to receive it according to the audit programme; confidentiality applies.

Follow-up audits may be scheduled to verify corrective actions; unclosed nonconformities are escalated to management review.

The audit programme is reviewed periodically for effectiveness, and results feed into the management review under Clause 9.3.