Orisynx
Book a demo

ISO 27001audit software

An ISO/IEC 27001 internal audit covers the management system clauses and the Annex A controls you selected in your Statement of Applicability. Orisynx keeps both in one checklist and turns every gap into a tracked corrective action.

Book a demo See the platform
Glass office towers and a crane in Abuja behind palm trees and street lamps under a cloudy sky

What an ISO 27001 audit asks of you

FND-0388High

Leavers’ accounts not disabled within the agreed 24 hours

Clause
A.5.18
Audit
Access control

Four of nine leavers sampled kept access for 3 to 11 days.

Clauses and controls together

Annex A groups its 93 controls into organizational, people, physical and technological themes. Build templates that follow the same structure.

Control owners do the fixing

Assign corrective actions and tasks to the people who own the control, with due dates and reminders.

A trail an auditor can follow

The activity log records who changed what and when, from the finding to the closed action.

The clauses, in your checklist

ISO 27001:2022 follows the ISO harmonized structure. Build your templates around its requirements and every finding stays tied to the clause it was raised against.

Clause titles are shown for orientation. Use your licensed copy of the standard for the full requirements.

ISO 27001:2022

Internal audit checklist · Information security

Context and leadership

  • Understanding the organization and its context4.1
  • Needs and expectations of interested parties4.2
  • Scope of the management system4.3
  • Leadership and commitment5.1
  • Policy5.2
  • Roles, responsibilities and authorities5.3

Planning and support

  • Actions to address risks and opportunities6.1
  • Objectives and planning to achieve them6.2
  • Competence7.2
  • Documented information7.5

Operation

  • Information security risk assessment6.1.2
  • Information security risk treatment6.1.3
  • Operational planning and control8.1
  • Annex A: 93 controls in four themesA.5–A.8

Evaluation and improvement

  • Monitoring, measurement, analysis and evaluation9.1
  • Internal audit9.2
  • Management review9.3
  • Nonconformity and corrective action10.2

Clauses 4 to 10
Harmonized structure

ISO 27001 questions

Does Orisynx support the 2022 version of ISO 27001?

Yes. You can start an audit against ISO/IEC 27001:2022 and build checklists around its clauses and the Annex A themes.

Can we audit only the controls in our Statement of Applicability?

Templates are yours to shape, so you can include exactly the controls that apply and leave out the ones you have excluded.

Can we keep evidence with each finding?

Files, links and notes can be attached to findings, corrective actions and tasks, and controlled documents live in the document library.

Other standards in the same programme

Run your next ISO 27001 audit here

Bring an audit you have already run. We will walk it through Orisynx with you, from the plan to the last closed corrective action.

Book a demo Already a customer? Log in