Internal Audits

This is the help text the console shows in the help panel on this page.

ISO 27001 clause 9.2 requires periodic internal audits to verify that the ISMS conforms to the standard and to your own policies. This page lists all your internal audits.

Audit Cards

Each card shows:

• Audit name, the auditor and the start date
• Status: Draft, In Progress, Completed or Signed (plus a Signed tag)
• Controls reviewed: “n/m controls reviewed” with a progress bar
• Open NCs: the number of open nonconformities, or “All NCs closed”

Creating an Audit

Click Create Audit, enter an audit name (e.g., “Internal Audit — Q1 2026”) and a start date. AutoCISO creates a checklist of your ISO 27001:2022 Annex A controls (93 in the full set) and pre-fills each control’s status from your latest gap analysis: compliant controls start as OK, and partial or missing controls start as Minor NC or Major NC (blocking ones as Major). Review and adjust each one.

Conducting the Audit

Click an audit to open the execution view, where you review each control, record findings and document nonconformities.

Audit Frequency

ISO 27001 expects internal audits at planned intervals. Many organizations run a full audit every year and spot checks in between.

Fields

Audit Name

A descriptive name for this audit campaign.

Examples: Annual Internal Audit 2025, Q3 Surveillance Audit, Post-Implementation Review.

Start Date

The date on which the audit period begins. This appears in the signed audit report and is used to track audit frequency compliance.