Internal audits and management review without a compliance team

Internal audits and management reviews are the two jobs small firms most often leave to the last month. They feel like paperwork, and nobody's day job includes them. Done well, though, they are how a business finds out what is really going on with its security, while there is still time to fix it.

This guide is for the owner or IT manager who has to run both without a compliance team.

What each one is for

An internal audit is a check, by someone suitably objective, on whether your ISMS is doing what you say it does and what the standard expects. ISO 27001 expects audits at planned intervals, so most firms set a yearly programme that covers the system over time.

A management review is a meeting where top management looks at how the ISMS is performing and decides what to change. It is expected at planned intervals too. Typical inputs are the status of earlier actions, changes in the business, audit results, incidents, whether objectives were met, and feedback from customers and other interested parties. The outputs are decisions and actions, not minutes for the sake of minutes.

For a business owner the value is practical: you hear about weak spots from your own people first, you can show customers a system that checks itself, and decisions about time and money are made with the facts in front of you.

Running the internal audit with a small team

• Keep the auditor independent of the work being audited. Nobody should audit their own area. In a very small firm that often means a colleague from another function or an outside person. Your certification body can tell you what it expects.
• Plan a programme, not a panic. Split the system across the year, with the riskier or recently changed areas covered sooner.
• Write down what you looked at and what you found. Findings should say what the requirement was, what was seen and where.
• Give every finding an owner and a date. An unowned finding turns up again at the next audit.
• Fix the cause, not just the symptom, and check later that the fix worked.

Running the management review in an hour

1. Prepare a short pack a week ahead: open actions, audit results, incidents, changes, objectives and anything customers have raised.
2. Hold the meeting with the people who can decide. Top management should be in the room, because the sign-off is theirs.
3. Leave with decisions: what changes, who does it, by when.
4. Record it, and feed the actions into your task list so they don't live only in minutes.

What goes wrong

• The audit is done by the person who built the system, so it finds nothing.
• Findings are noted and never followed up.
• The review happens once a year in a rush, using whatever can be remembered.
• Actions sit in a document nobody opens.

All four come down to the same thing: nobody is chasing in the quiet months.

How ClearIMS helps

ClearIMS records internal audits, management reviews and nonconformities as owned, dated records, with recurring tasks so they come round on time. Audit findings can raise linked nonconformities, and a nonconformity can't be closed without its root cause, corrective action and effectiveness review. Signing off a management review needs a top-management approver, and each approval records who approved it, which version and when. It also emails people about overdue actions, so the follow-up does not depend on one person's memory. An AI audit check, which is practice only and the AI's own view, can give you a second look before the real thing. The AI never approves anything, and your certification body decides whether to certify you.

Questions people ask

Can the person who runs our ISMS also audit it? Generally not for their own work, because the audit needs to be objective. A colleague from another area or an outside person is the usual answer.

How long should a management review take? It depends on the size of the business. A short meeting with a prepared pack is often enough for a small firm.

Does ClearIMS do the audit for us? No. It keeps the records, reminders and follow-up. People do the auditing and the approving.

Next step

It is easier to keep both on schedule when they are recurring tasks with owners than when they are a calendar entry in October. The price is £300 a month, monthly with 30 days' notice, unlimited users, no VAT charged. Related reading: surveillance audit preparation, what to do when one person holds the whole ISMS, and keeping an existing certificate going. Sector pages: public-sector suppliers, NHS suppliers and ISPs and altnets.

Book a 20-minute call or try the demo company to see it working first.