However, as Internal Audit, you work for - or at least in conjunction with - the organisation's senior management and would presumably be expected to support the organisation's strategic aims. ”Ī: If you are a truly independent audit team, you do not answer to the ISMS project team and they cannot force you to provide information or do things for them in a certain way. Is this information really needed? Are we (as an independent audit team) forced to give them such information? Should we perform a quick Internal Audit or take the time necessary although the certification would be postponed? Are there ISMS Audit Programme/Plan templates we can use and what other considerations should we take into account for the ISMS internal Audit?. They are asking for a load of things from us and expect us to do the audit within a tight timescale defined on their plans. We have been asked by the ISMS implementation project team to perform an ISMS internal audit as a prelude to an external/third party certification audit against ISO/IEC 27001.

How should prepare for a recertification audit?įAQ: “I work for an Internal Audit function.

What if things change after we are certified?.

Why isn’t there a simple checklist we can follow?.

Do we need to address all the control objectives in ISO/IEC 27002?.

How does the certification process work?.

Who can certify us against ISO/IEC 27001?.

Are there levels or degrees of conformity?.

Will the controls we already have be sufficient for certification?.

What is really involved in becoming ISO/IEC 27001 certified?.

OK then, how do we get certified against ISO/IEC 27001?.

How does my organisation get certified against ISO/IEC 27002?.

How will the certification auditors check our ISMS internal audit processes?.

Will the certification auditors check our information security controls?.

How can we ascertain whether the control objectives are fulfilled?.

How can we confirm the implementation of controls in the SoA?.How should we conduct ISMS internal audits?.

What considerations should we take into account for ISMS internal audits?.

This section of the ISO27k FAQ concerns internal auditing of an ISMS and formal certification against ISO/IEC 27001:

Audit checklist iso 27001 controls