ISO/IEC 27001 requires internal audits at planned intervals. In Varmo, you plan your audit programme under “Audits”, conduct internal and external audits and handle the findings in the register through to the effectiveness review. This guide is aimed at ISMS managers, lead auditors and those responsible for findings.

Before you start

  • People with the permissions to manage “Audits” or “Findings” plan audits and manage findings; by default, the ISMS managers.
  • The lead auditor of an internal audit sees their audit even without this permission (under My audits) and records the findings during the audit.
  • For internal audits, choose a lead auditor who does not audit areas they are responsible for themselves.

Planning an audit

  1. Open Audits and click Plan audit.
  2. Choose the type: Internal audit (by your own auditors) or External audit, for example a certification audit.
  3. Enter the title, scope (areas, processes, sites), audit criteria and the period. Optionally, choose the requirement catalogue being audited.
  4. Specify the Lead auditor or, for external audits, the External body.

A good start is an annual audit of clauses 4–10 and, on a rotating basis, parts of Annex A.

Audit programme: ISO/IEC 27001 (9.2.2) requires an audit programme with frequency, methods, responsibilities and reporting that takes into account the importance of the processes and the results of previous audits. In Varmo, the planned audits with scope and audit criteria form this programme; the results go to management via the management review.

  1. ISMS managerPlan audit

    Type, scope, audit criteria and lead auditor.

  2. Lead auditorStart audit

    With declaration of independence.

  3. Lead auditorRecord finding

    Major nonconformity, minor nonconformity, observation or opportunity for improvement.

  4. Responsible personRecord correction and cause

    For nonconformities, the cause is required.

  5. Person responsible for the measureImplement measure

    The effectiveness review is then requested.

  6. Another personReview effectiveness

    Never the person responsible for the finding or who requested the review.

Not effective

The finding returns to treatment with a justification.

Close without measure

Only for observations and opportunities for improvement, with a justification.

From the audit to an effective correction

Six steps: the ISMS managers plan the audit. The lead auditor starts it with their declaration of independence and records findings. The responsible person records the correction and cause and specifies a measure, which is implemented. Another person then reviews the effectiveness; if it is not effective, the finding returns to treatment. Observations and opportunities for improvement can be closed without a measure, with a justification.

Conducting an audit

  1. Starting: from 14 days before the start, the lead auditor receives the task “Start audit”. They click Start audit and confirm their Declaration of independence. Varmo records this declaration but does not check independence itself. An internal audit can only be started by the lead auditor themselves. External audits are started by the people who plan audits.
  2. Recording findings: in the ongoing audit, click Record finding. Choose the type (major nonconformity, minor nonconformity, observation or opportunity for improvement), describe what was found and with which evidence, and if needed choose the affected requirement, the affected asset and the responsible person.
  3. Completing: with Complete audit, you record the conclusion and upload the audit report as a PDF. After that, the audit cannot be changed.

If a planned audit does not take place, you cancel it with a justification.

Handling findings

The responsible person handles the finding under Findings. A finding goes through the statuses “Recorded”, “In treatment”, “Effectiveness review” and “Closed”:

  1. Record correction and cause: what was done immediately (immediate correction), why did it happen (cause) and can the same thing occur elsewhere? For nonconformities, the cause is required. Also check whether policies, risks or processes of your ISMS need to be adjusted.
  2. Specify a measure: create a New measure or choose an existing one. The person responsible for the measure receives a task.
  3. Request the effectiveness review: once all measures have been implemented, request the review.
  4. Review effectiveness: another person with management permission confirms the effectiveness or returns the finding with Not effective – back to treatment and a justification.

You can also close observations and opportunities for improvement with a justification using Close without measure. If you want to check regularly that a nonconformity does not recur, create an internal control for it.

What happens next

  • As soon as a finding has a responsible person, they receive a task in My tasks, even while the audit is still ongoing.
  • If a finding has no responsible person, the people who manage findings receive the task “Assign responsible person”.
  • The reviewer receives the task “Review effectiveness”. Whoever is responsible for the finding or requested the review does not review it themselves.
  • Audits and open findings are included in the next management review.

Frequently asked questions

Can I delete an audit?

Only as long as it is planned and has no findings. You cancel or complete audits that have started.

How do I pass on the register, for example to a certification body?

Under Findings, you download the list with CSV. Findings of a certification body are recorded in the external audit by people who manage findings.

Who sees a finding?

People with read permission for findings (e.g. the functional role “Internal audit & review (read only)”), the responsible person and the person who recorded it, as well as the lead auditor of its audit.