Lion Cipher Lab
Conduct an ISO/IEC 27001 internal audit
- GRC / Compliance
- Intermediate
- ~55 min
- Free · no account required
Why it matters
An information security management system lives or dies on a single, uncomfortable question: does the thing you wrote down actually happen? Your Statement of Applicability is a signed declaration that certain controls apply and are in place — a promise. But promises drift. The joiner-leaver process that looked airtight in the policy quietly stops being followed when the person who ran it leaves; the vulnerability scan that the policy says is monthly slips to 'when someone remembers'; the access-review that management believes happens has not run since the tool changed. The Clause 9.2 internal…
What you'll learn
- planning an ISO/IEC 27001 Clause 9.2 internal audit
- building a risk- and importance-based audit programme
- defining audit scope, criteria, and objectives
- writing an audit checklist tied to clauses, the SoA, and policies
- gathering objective evidence by interview, observation, and record sampling
- applying the say / do / show test to controls
- classifying findings as conformity, nonconformity, or opportunity for improvement
- writing a defensible nonconformity statement
- distinguishing correction from corrective action
- running a 5 Whys root-cause analysis and raising a Clause 10.1 corrective action
Steps in this lab
- The words first: ISMS, internal audit, and why Clause 9.2 exists
- Build an audit programme (Clause 9.2.2): schedule by risk, not all at once
- Plan ONE audit: scope, criteria, objectives
- Gather objective evidence: interview, observe, sample — the say / do / show test
- Classify what you found: conformity, nonconformity (major vs minor), or opportunity
- Raise corrective action (Clause 10.1): correction vs corrective action, and root cause
- Judgment: why this is a mirror, not a gotcha — and how a pro runs it