Iso27001 Internal Auditor

ISO 27001:2022 Internal Auditor

Overview

This skill provides comprehensive guidance for conducting ISO 27001:2022 internal audits of Information Security Management Systems (ISMS), with specific focus on:

• 7-step audit methodology from planning to corrective action follow-up
• Vanta platform integration for evidence review and audit management
• All ISO 27001:2022 requirements (Clauses 4-10 + 93 Annex A controls)
• Finding classification (nonconformities, observations, recommendations)
• SaaS company considerations (cloud controls, multi-tenancy, DevSecOps)

Designed for experienced compliance teams performing annual internal audits.

Keywords: ISO 27001, internal audit, ISMS, Vanta, nonconformity, audit findings, Annex A controls, information security, audit report

When to Use This Skill

Use this skill when you need to:

• Conduct annual ISO 27001 internal audit
• Review and analyze evidence exported from Vanta
• Create audit checklists for ISO 27001:2022
• Identify nonconformities, observations, and recommendations
• Write professional internal audit reports
• Document corrective action requests
• Perform corrective action follow-up
• Ensure complete coverage of all ISO 27001 requirements

The 7-Step Internal Audit Process

ISO 27001 internal audits follow a structured 7-step methodology:

Step 1: Document Review

Purpose: Review ISMS documentation for compliance and prepare for main audit

Activities:

• Review Information Security Policy
• Review all applicable procedures and documented information
• Review Statement of Applicability (SoA)
• Review Risk Assessment and Risk Treatment Plan
• Review records (management review, incidents, corrective actions)
• Check documentation against ISO 27001:2022 requirements
• Identify areas to investigate during main audit

In Vanta:

• Export and review all policies
• Review control implementation status
• Examine risk register and treatment plans
• Review completed tasks and tests
• Check document versioning and approval status

Output: Notes on potential nonconformities, areas requiring investigation

Template: Use the Vanta audit workflow guide from references/vanta_audit_workflow.md

Step 2: Create Internal Audit Checklist

Purpose: Prepare structured notes to guide the main audit

Activities:

• List all requirements to be audited (clauses + Annex A controls)
• Note what evidence to look for
• Identify who to interview
• Plan which records to sample
• Prepare questions based on document review findings

Four-Column Format:

1. Reference - Clause or control number
2. What to look for - Requirements, questions, evidence to examine
3. Compliance - Y/N/Partial/N/A (fill during audit)
4. Findings - Evidence found (fill during audit)

Template: references/audit_checklist_complete.md (93 Annex A controls + clauses 4-10, plus ISO 22301)

Step 3: Write Audit Plan

Purpose: Define detailed logistics for the audit

Activities:

• Set audit dates and times
• Identify departments/processes to audit
• List contact persons for each area
• Define audit team roles (if multiple auditors)
• Communicate plan to auditees
• Schedule opening meeting (if applicable)

Guidance: See references/iso_internal_audit_guide_full.md Section 3.5 for audit plan structure

Step 4: Conduct Main Audit

Purpose: Gather evidence through on-site examination

Three Evidence Collection Techniques:

1. Reviewing Documents and Records:

   • Most reliable evidence
   • Examine policies, procedures, records
   • Check Vanta evidence uploads (screenshots, logs, reports)
   • Verify document versions, approval dates, completeness

2. Interviewing Employees:

   • Speak to multiple people for same process to corroborate evidence
   • Use open-ended questions: "Please describe how you control access to the IT system" — lets the auditee reveal how things actually work
   • Avoid closed-end questions ("Is this your backup server?") — only use these to confirm specific evidence
   • Use the "Five Whys" technique to find root causes: keep asking "Why?" until you reach the underlying problem (often takes ~5 iterations)
   • Verify understanding of procedures and awareness of responsibilities
   • Record exact quotes as evidence

3. Observing Activities and Facilities:

   • Visit server rooms, secure areas
   • Observe processes in action
   • Check physical security controls
   • Verify configurations match documentation

Opening Meeting (optional for internal audits): Brief management on audit objectives, scope, timing, and how findings will be reported. Useful for larger organizations or when auditees are unfamiliar with the process.

During Main Audit:

• Follow your checklist but remain flexible — don't miss leads not on your checklist
• Document all evidence immediately
• Record exact names, dates, versions
• Note direct quotes from interviews
• Take photos/screenshots if appropriate
• Don't make assumptions — verify everything (the biggest auditor mistake is assuming a requirement exists when it doesn't)
• You choose which records to sample, not the auditee

Closing Meeting (optional for internal audits): Present nonconformities and observations to management. Not mandatory for smaller companies but useful for formalizing communication of findings.

Recording Evidence:

• Fill columns 3 and 4 of your checklist
• Note specific evidence (document names, record IDs, person names)
• Reference Vanta evidence (task IDs, test results, policy versions)
• Document timestamps and locations

Step 5: Write Internal Audit Report

Purpose: Document all findings formally

Required Sections:

1. General Information:

   • Audit date, auditor name(s)
   • Audit scope and criteria
   • Audit objectives
   • Auditees

2. Audit Findings:

   • Nonconformities (with full structure - see below)
   • Observations (potential issues, best practices not followed)
   • Recommendations (improvement opportunities)

3. Audit Conclusions:

   • Overall compliance assessment
   • System effectiveness evaluation
   • Readiness for certification audit
   • Key themes or patterns

Nonconformity Structure (4 elements):

1. Reference: Exact clause/control number (e.g., "ISO 27001:2022 Clause 6.1.2")
2. Requirement: Brief description of requirement not met
3. Finding: What was found (the gap)
4. Evidence: Specific proof (document name, interview quote, observation details)

Template: templates/internal_audit_report.md

Step 6: Initiate Corrective Actions

Purpose: Formally request resolution of nonconformities

Activities:

• Create Corrective Action Request (CAR) for each nonconformity
• Assign responsible person
• Set deadline for resolution
• Define root cause analysis requirement
• Track in Vanta or corrective action system

Template: templates/nonconformity_report.md

In Vanta:

• Create tasks for each nonconformity
• Assign to control owners
• Set due dates
• Link to audit findings
• Track remediation progress

Step 7: Corrective Action Follow-Up

Purpose: Verify nonconformities are actually resolved

Activities:

• Review completed corrective actions
• Verify evidence of implementation
• Conduct mini-audit of corrected areas
• Confirm root cause addressed
• Close CARs or re-open if inadequate
• Update audit records

Timeline: Typically 30-90 days after audit depending on NC severity

In Vanta:

• Review corrective action task completion
• Verify new evidence uploaded
• Validate control status updated
• Close audit findings

Working with Vanta Platform

Three Methods for Evidence Retrieval

Method 1: Vanta API Scripts (Automated - Recommended)

• Use scripts/vanta_api/retrieve_all.py for bulk export
• Automated download of all policies and evidence
• Auto-generates audit notes with potential findings
• See: references/vanta_api_integration.md

Method 2: Vanta MCP Server (Interactive)

• Real-time queries during audit conversations
• Natural language evidence retrieval
• Integrated with Claude Desktop
• See: mcp/mcp_setup_guide.md and mcp/mcp_audit_workflow.md

Method 3: Manual Export (Fallback)

• Traditional manual download from Vanta web interface
• Use when API/MCP not available

Vanta Exports for Audit

Using API Scripts (Recommended):

# Retrieve all policies and evidence automatically
cd scripts/vanta_api
python3 retrieve_all.py

# Creates organized exports in vanta_exports/

Using MCP Server (Interactive): In Claude Desktop with Vanta MCP configured:

"Using Vanta MCP Server, export all policies and check for overdue reviews"

Manual Export (if needed): Before the audit, export from Vanta:

Policies:

• All current policies (markdown or PDF)
• Version history
• Approval records
• Review dates

Controls:

• Control implementation status
• Control owners
• Test results
• Evidence uploads

Risks:

• Risk register export
• Risk assessments
• Treatment plans
• Risk owners

Tasks:

• Completed and pending tasks
• Task assignments
• Completion dates
• Evidence attached to tasks

Tests:

• Automated test results
• Manual test records
• Test frequencies
• Pass/fail status

Vendors:

• Vendor inventory
• Security assessments
• Questionnaire responses
• Vendor risk ratings

Analyzing Vanta Evidence

Policy Review:

• ✓ Check: All required policies exist (see Annex A.5.1)
• ✓ Check: Policies approved by management
• ✓ Check: Policies reviewed within 12 months
• ✓ Check: Policies communicated to personnel
• ✓ Check: Version control maintained
• ✗ Common Gap: Policies not formally approved
• ✗ Common Gap: Review dates overdue

Control Implementation:

• ✓ Check: All applicable controls from SoA implemented
• ✓ Check: Control owners assigned
• ✓ Check: Testing completed per schedule
• ✓ Check: Evidence uploaded and adequate
• ✗ Common Gap: Controls marked "implemented" but no evidence
• ✗ Common Gap: Test frequency not followed

Risk Assessment:

• ✓ Check: Risk assessment methodology documented
• ✓ Check: All assets have risks identified
• ✓ Check: Likelihood and impact assessed
• ✓ Check: Treatment plans for unacceptable risks
• ✓ Check: Risk owners assigned
• ✗ Common Gap: Risk assessment not updated in 12 months
• ✗ Common Gap: Treatment plans incomplete

Use: references/vanta_audit_workflow.md for systematic Vanta evidence review

Vanta Evidence Reference Format

When documenting findings, reference Vanta evidence clearly:

Good Example:

"Evidence: Vanta Policy 'Access Control Policy v2.1' shows last review date of 2023-01-15, exceeding the 12-month review requirement (ISO 27001:2022 Clause A.5.1). Current date: 2024-11-04 (22 months since review)."

Good Example:

"Evidence: Vanta Control 'A.8.15 - Logging' status shows 'Implemented' but no test results uploaded. Control owner: IT Manager. Last test date field: empty."

Finding Classification

Nonconformity (NC)

Definition: A requirement is not met

When to Raise NC:

• ISO 27001:2022 requirement violated
• Company's own policy/procedure not followed
• Legal/regulatory requirement not met
• Contractual requirement (SLA, customer) not met

NC Must Have:

1. Clear evidence of the gap
2. Specific requirement violated
3. Impact on ISMS effectiveness

Major NC:

• Complete absence of required element (e.g., no management review performed)
• Systematic failure (e.g., backup performed randomly, not daily as required)
• Multiple minor NCs in same area (indicates systemic problem)
• Previous NC not resolved by deadline

Minor NC:

• Isolated incident (e.g., backup missed one day)
• Documentation gap (e.g., one training record missing)
• Requirement partially met

Examples:

Major NC Example:

Reference: ISO 27001:2022 Clause 9.3 (Management Review)

Requirement: Management review must be conducted at planned intervals

Finding: No management review was conducted in 2024. The ISMS procedure requires annual management review by Q1 each year.

Evidence: Management review procedure v1.2 states "annual review by March 31." No meeting minutes, agenda, or attendance records found for 2024. Interview with CISO (2024-11-01) confirmed no review conducted. Vanta tasks for management review show status "Not Started."

Minor NC Example:

Reference: ISO 27001:2022 Clause A.7.2 (Competence)

Requirement: Training records must be maintained for all personnel

Finding: Training record for security awareness training is missing for one new employee hired in October 2024.

Evidence: Vanta training tracker shows 47/48 employees completed security awareness training. Employee "J. Smith" (hired 2024-10-15) shows no training completion. HR Manager confirmed employee not yet trained due to onboarding delay.

Observation

Definition: Potential issue that could become a nonconformity

When to Raise Observation:

• Isolated deviation that doesn't impact ISMS effectiveness
• Process that could be improved but meets minimum requirements
• Best practice not followed (but not required)
• Early warning of potential future NC

Example:

Observation: The Incident Response Procedure was last reviewed 11 months ago, approaching the 12-month review requirement. While currently compliant, establish a reminder process to ensure timely reviews.

Recommendation

Definition: Improvement opportunity beyond compliance

When to Raise Recommendation:

• Efficiency improvements possible
• Industry best practices not adopted
• Additional security measures would be beneficial
• Process optimization opportunities

Example:

Recommendation: Consider implementing automated policy review reminders in Vanta. While manual tracking is compliant, automation would reduce administrative burden and ensure no policies exceed review dates.

ISO 27001:2022 Audit Scope

Clauses 4-10 (ISMS Requirements)

Clause 4 - Context of the Organization:

• 4.1: Understanding organization and context
• 4.2: Understanding needs of interested parties
• 4.3: Determining scope of ISMS
• 4.4: Information security management system

Clause 5 - Leadership:

• 5.1: Leadership and commitment
• 5.2: Policy
• 5.3: Organizational roles, responsibilities, authorities

Clause 6 - Planning:

• 6.1: Actions to address risks and opportunities
• 6.1.1: General
• 6.1.2: Information security risk assessment
• 6.1.3: Information security risk treatment
• 6.2: Information security objectives and planning
• 6.3: Planning of changes

Clause 7 - Support:

• 7.1: Resources
• 7.2: Competence
• 7.3: Awareness
• 7.4: Communication
• 7.5: Documented information

Clause 8 - Operation:

• 8.1: Operational planning and control
• 8.2: Information security risk assessment
• 8.3: Information security risk treatment

Clause 9 - Performance Evaluation:

• 9.1: Monitoring, measurement, analysis and evaluation
• 9.2: Internal audit
• 9.3: Management review

Clause 10 - Improvement:

• 10.1: Nonconformity and corrective action
• 10.2: Continual improvement

For detailed audit questions per clause, see: references/audit_checklist_complete.md

Annex A Controls (93 Controls in ISO 27001:2022)

Organizational Controls (A.5.1 - A.5.37): 37 controls People Controls (A.6.1 - A.6.8): 8 controls Physical Controls (A.7.1 - A.7.14): 14 controls Technological Controls (A.8.1 - A.8.34): 34 controls

Total: 93 controls

Complete checklist: references/audit_checklist_complete.md

SaaS-Specific Audit Considerations

Cloud Infrastructure Controls

Key Annex A Controls for SaaS:

• A.5.23: Information security for cloud services
• A.8.9: Configuration management
• A.8.14: Redundancy of information processing facilities
• A.8.20: Networks security
• A.8.31: Separation of development, testing, production

What to Audit:

• Cloud provider selection and monitoring (A.5.22)
• Shared responsibility model documentation
• Cloud configuration management
• Multi-region deployment for redundancy
• Infrastructure as Code (IaC) security

Vanta Evidence:

• Cloud provider SOC 2 reports
• Configuration management policies
• Infrastructure diagrams
• Backup and DR procedures
• Cloud security posture test results

Multi-Tenant Security

Key Controls:

• A.5.10: Acceptable use of information
• A.5.14: Information transfer
• A.8.11: Data masking
• A.8.12: Data leakage prevention
• A.8.22: Segregation in networks

What to Audit:

• Tenant data isolation mechanisms
• Cross-tenant access prevention
• Tenant-specific access controls
• Data segregation architecture
• Isolation testing results

Vanta Evidence:

• Multi-tenancy architecture documentation
• Tenant isolation test results
• Access control configurations
• Penetration test reports focusing on isolation

DevSecOps and CI/CD

Key Controls:

• A.8.25: Secure development lifecycle
• A.8.26: Application security requirements
• A.8.27: Secure system architecture
• A.8.28: Secure coding
• A.8.29: Security testing
• A.8.30: Outsourced development
• A.8.32: Change management

What to Audit:

• CI/CD pipeline security controls
• Code review processes
• Security testing (SAST, DAST, SCA)
• Secrets management
• Deployment approval processes
• Rollback procedures

Vanta Evidence:

• Secure SDLC policy
• Code review records
• Security scan results
• Deployment logs
• Change management tickets

For SaaS-specific finding examples, see: examples/sample_audit_findings_saas.md

Evidence Analysis and Sampling

Sampling Principles

When you cannot examine all records:

Focus On:

• High-risk areas from risk assessment
• Critical controls (access control, encryption, backup)
• New employees (higher likelihood of training gaps)
• Recent changes (higher likelihood of issues)
• Previous audit findings (verify resolution)

Sample Size Guidelines:

• Small population (< 20): Review all
• Medium population (20-100): Review 10-30%
• Large population (> 100): Review statistical sample or risk-based selection

Auditor Choice: You select records to sample, not the auditee

Vanta Evidence Adequacy

Adequate Evidence:

• ✓ Screenshots showing actual configurations
• ✓ Logs with timestamps and relevant data
• ✓ Approved policy documents with dates
• ✓ Test results with pass/fail criteria
• ✓ Training completion with names and dates

Inadequate Evidence:

• ✗ Generic screenshots without context
• ✗ Undated documents
• ✗ Incomplete logs
• ✗ "Evidence pending" status for implemented controls
• ✗ Self-attestations without supporting proof

When Evidence is Inadequate: Raise observation or NC depending on severity

Writing Effective Audit Findings

Nonconformity Template

**NC-[number]**: [Brief title]

**Classification**: ☐ Major  ☐ Minor

**Reference**: ISO 27001:2022 [Clause/Control number]

**Requirement**: [Quote or paraphrase the requirement]

**Finding**: [Describe what was found that doesn't meet the requirement]

**Evidence**:
- [Specific evidence item 1 with source, date, location]
- [Specific evidence item 2]
- [Interview with [Person, Title] on [Date]]

**Impact**: [Brief description of impact on ISMS]

**Recommendation**: [Suggested corrective action - optional]

Good vs. Poor Finding Examples

Poor NC (vague, no evidence):

"Access control is not working properly."

Good NC (specific, clear evidence):

Reference: ISO 27001:2022 Control A.5.18

Requirement: Access rights shall be reviewed at regular intervals

Finding: Access review was not performed in 2024. The Access Control Policy (v1.5, dated 2023-03-15) requires quarterly access reviews.

Evidence:

• Access Control Policy v1.5, Section 4.3 states "Quarterly review by IT Security Manager"
• No access review reports found in shared drive for Q1, Q2, Q3 2024
• Interview with IT Security Manager (2024-11-01): confirmed reviews not conducted due to resource constraints
• Vanta Control A.5.18 status: "Implemented" but last test date: 2023-12-10

Impact: Inappropriate access rights may persist, increasing risk of unauthorized access or privilege escalation.

Audit Program and Planning

Annual Audit Program

Must Define:

• Audit schedule for the year
• Which areas/departments to audit when
• Audit scope for each audit
• Audit criteria (ISO 27001:2022, policies, legal requirements)
• Audit methods (document review, interview, observation)
• Auditor assignments

Guidance: See references/iso_internal_audit_guide_full.md Section 3.4 for annual audit program structure

Focus Areas (prioritize based on risk):

• Areas with high-risk assets
• Critical controls (access, encryption, backup)
• Areas with previous nonconformities
• New systems or significant changes
• Outsourced processes
• Third-party management

Auditor Independence

Conflict of Interest Rules:

• Auditor cannot audit their own work
• Need minimum 2 auditors to cross-audit
• Auditor cannot report to person being audited
• External auditor acceptable if internal expertise lacking

Auditor Competencies:

• Knowledge of ISO 27001:2022
• Understanding of ISMS principles
• Familiarity with company operations
• Industry knowledge (SaaS for this skill)
• Auditing techniques
• Communication skills
• Evidence evaluation skills

Common Pitfalls to Avoid

Auditor Mistakes

1. Making Assumptions: Don't assume something is required - verify the actual requirement
2. Being Too Prescriptive: Focus on "what" (requirements) not "how" (implementation)
3. Inadequate Evidence: Every NC must have clear, documented evidence
4. Missing Root Causes: Don't just identify symptoms, find underlying causes
5. Poor Communication: Deliver findings diplomatically, not accusatorially
6. Checklist Slavery: Use checklist as guide, not rigid script
7. Ignoring Positive Findings: Note good practices, not just problems

Documentation Mistakes

1. Vague Language: "Some," "regularly," "management" without specifics
2. Missing Evidence References: Every finding must cite specific evidence
3. Unclear Requirements: Must quote or precisely reference the standard
4. Inconsistent Findings: Same issue treated differently in different departments
5. Typographical Errors: Proofread before submitting

Typical Audit Timeline

Pre-Audit (2-4 weeks before):

• Week 1-2: Document review, Vanta export analysis
• Week 2-3: Checklist creation, audit plan finalization
• Week 3-4: Communicate audit plan to auditees

Main Audit (1-3 days):

• Day 1 AM: Opening meeting, begin interviews
• Day 1 PM - Day 2: Evidence collection, interviews, observations
• Day 2-3: Complete evidence gathering, preliminary findings

Post-Audit (1-2 weeks):

• Week 1: Compile findings, draft report
• Week 2: Finalize report, present to management, initiate CARs

Follow-Up (30-90 days later):

• Verify corrective actions implemented
• Close nonconformities
• Update audit records

Best Practices for Success

1. Prepare Thoroughly: Document review and checklist creation are critical
2. Stay Objective: Evidence-based findings only
3. Be Specific: Names, dates, versions, locations in all evidence
4. Communicate Clearly: Explain findings in plain language
5. Focus on Improvement: Audit is tool for system improvement, not blame
6. Reference Vanta: Link findings to specific Vanta evidence IDs
7. Document Immediately: Write evidence while fresh
8. Verify Understanding: Confirm your interpretation with auditees
9. Think Risk-Based: Prioritize high-risk areas
10. Follow Through: Audit isn't complete until CARs verified

Resources

Reference Documents

• references/iso_internal_audit_guide_full.md - Complete plain English audit guide (7-step process, interviewing techniques, evidence collection)
• references/audit_checklist_complete.md - Full ISO 27001 + ISO 22301 audit checklist
• references/vanta_audit_workflow.md - Vanta platform integration and evidence review
• references/vanta_api_integration.md - Vanta Audit API setup and usage
• references/nonconformity_procedure.md - NC handling procedure
• references/audit_report_template_base.md - Simple audit report format

Templates

• templates/internal_audit_report.md - Comprehensive audit report template
• templates/nonconformity_report.md - NC documentation with root cause analysis and corrective action tracking

Examples

• examples/sample_audit_findings_saas.md - Real-world SaaS finding examples (NCs, observations, recommendations)

MCP Integration

• mcp/mcp_setup_guide.md - Vanta MCP server setup for interactive queries
• mcp/mcp_audit_workflow.md - Using MCP during audit conversations

Scripts

• scripts/vanta_api/retrieve_all.py - Bulk export all audit evidence from Vanta
• scripts/vanta_api/retrieve_controls.py - Retrieve specific controls
• scripts/vanta_api/retrieve_evidence.py - Retrieve evidence files
• scripts/vanta_api/list_audits.py - List audit records
• scripts/vanta_api/vanta_auth.py - OAuth 2.0 authentication helper

Quick Start

1. Export from Vanta: Use scripts/vanta_api/retrieve_all.py or manual export (policies, controls, risks, tests, tasks)
2. Review Exports: Follow references/vanta_audit_workflow.md for systematic evidence analysis
3. Create Checklist: Use references/audit_checklist_complete.md as your four-column audit checklist
4. Plan Audit: Define scope, timing, contacts per references/iso_internal_audit_guide_full.md Section 3.5
5. Conduct Audit: Follow 7-step methodology, use interviewing techniques from Section 5.6
6. Document Findings: Use nonconformity structure (reference, requirement, finding, evidence)
7. Write Report: Use templates/internal_audit_report.md
8. Initiate CARs: Use templates/nonconformity_report.md, create tasks in Vanta

Your internal audit should be thorough, evidence-based, and focused on improving the ISMS effectiveness, not just checking boxes for certification.