Internal audits show that your security measures really work, as ISO 27001 (clauses 9.2 and 10.2) and NIS2 Article 21(2)(f) expect. In CloudSignLab you plan each audit, record what it found and follow every corrective action until it is closed. Audits are numbered AUD-1, AUD-2 and so on, findings F-1, F-2 and so on.
How to plan an audit
- In your organization, open Internal audits in the menu.
- Click Plan an audit.
- Enter a Title and the Scope and criteria: what is audited, against which requirements and who audits. Name external auditors here.
- Choose the Lead auditor and the Planned date, then click Save audit.
- As the audit goes on, change the Status to In progress, Completed or Cancelled, and write the Conclusion at the end.
How to record findings
- Open the audit and go to Findings and corrective actions.
- Click Add finding and choose the Type: major nonconformity, minor nonconformity, observation or opportunity for improvement.
- Describe the Corrective action, choose who is Responsible and set a Due date. If it fits, link the finding to a Control of your organization.
- Click Save finding. Set the status to Closed once the action is done.
Open findings with a due date appear in Tasks as a corrective action, and an overdue one gets a reminder.
For members
Members can read audits. A finding given to you is marked Given to you: use Report progress to describe what was done and update its status. Everything else needs an owner or admin.
Tips
- Deleting an audit also deletes its findings; the audit log keeps a record that they existed.
- Every change is shown in the audit's History.
- Internal audits are included from the Professional package. Your package may limit the number of audits; findings are never limited.