# ISMS audit plan starter

Use this when you plan an ISO/IEC 27001 audit, internal, supplier or certification. It follows the audit
stages PECB's ISO/IEC 27001 Lead Auditor exam is built on: preparing, conducting and closing an audit, and
managing the audit program. ISO/IEC 27001 is sold rather than published, so check requirement wording
against your own copy of ISO/IEC 27001:2022.

## Before the audit

- [ ] Who commissioned it, and what kind it is: first-party, second-party or third-party
- [ ] Audit objectives: ____________ (a stage 2 certification audit and a surveillance audit have different ones)
- [ ] Audit scope, inside the ISMS scope, with sites and processes named
- [ ] Audit criteria: ISO/IEC 27001:2022 and the organization's own documented information
- [ ] The Statement of Applicability, with its version number and date, received and read
- [ ] Previous audit findings and the corrective actions taken
- [ ] Team members, any technical expert, and who leads
- [ ] Remote or on-site techniques, and how evidence will be gathered either way

## During the audit

- [ ] A sampling plan you could defend to another competent auditor
- [ ] Objective evidence recorded for each conclusion: documents, observation, interviews with named roles
- [ ] Nothing accepted on a manager's assurance alone

## Writing findings

- [ ] Each nonconformity report states the exact requirement, the objective evidence and a clear statement of
      what is not met
- [ ] Major or minor graded on the evidence: a complete failure of a required process, or significant doubt
      that the system can achieve its outcomes, is major
- [ ] A correction (fixing the immediate problem) kept distinct from corrective action (removing the root cause)

## Closing

- [ ] Closing meeting held, with the sampling disclaimer explained: evidence is a sample and carries uncertainty
- [ ] Audit report with objectives, scope, criteria, findings and conclusions
- [ ] Follow-up agreed for each nonconformity