An internal control is a check that your organisation carries out at a fixed frequency and records with evidence, for example “Review ERP permissions quarterly” or “Test restore”. Together, the internal controls form your internal control system (ICS) and support monitoring under ISO/IEC 27001, clause 9.1. This article is aimed at ISMS managers and people who carry out internal controls.

Before you start

  • You find the internal controls in the menu under Internal controls. Anyone who only carries out their own internal controls sees My internal controls there.
  • People with the “Internal controls: Manage” permission may create and change internal controls, map requirements and handle deficiencies; by default, the ISMS managers.
  • Executions are recorded by the person responsible for the internal control or by whoever manages internal controls.
  • Internal controls are included in all plans.

Creating an internal control

  1. Open Internal controls and click New internal control.
  2. Enter the Title, for example “Review ERP permissions”, and the Control objective: what should be ensured?
  3. Under Procedure, describe the check steps and under Expected evidence what should be available at the end, for example “signed role list as PDF”.
  4. Choose the Frequency (e.g. quarterly or One-off) and First execution by.
  5. Choose who is Responsible (performs it) and, under Checks requirements, the requirements that the internal control provides evidence for.
  6. Click Create internal control.

The Annual plan view shows all due dates of the year based on the frequency.

Recording an execution

  1. Open the internal control and click Record execution.
  2. Enter when it was Carried out on and upload the Evidence (PDF). The evidence is required.
  3. Choose the Result: Effective if the check found nothing, or Deficiency if something does not work as intended. For a deficiency, describe what was found.
  4. Save. Varmo sets the next due date based on the frequency.

Remediating a deficiency

For a deficiency, people who manage internal controls use Remediate deficiency to specify how it is remediated: with a New measure (Title, Description, Responsible and Implement by) or with an existing measure under Choose existing. The person responsible for the measure receives a task. Whether the deficiency has been remediated is shown by the next execution of the internal control; for a one-off internal control, you record a Recheck for this.

  1. ISMS managerCreate

    Frequency, responsible person, expected evidence.

  2. Responsible personCarry out

    With evidence as PDF.

  3. Responsible personResult

    Effective or deficiency.

Deficiency

A measure remediates it; the next execution or the recheck shows whether it has been remediated.

An internal control over the year

An internal control is created and carried out by the responsible person before each due date. The execution is recorded with evidence as effective or with a deficiency. For a deficiency, a measure to remediate it is specified; the next execution shows whether the deficiency has been remediated.

What happens next

  • 7 days before each due date, the responsible person receives the task Carry out internal control, after the date Internal control overdue.
  • If there is no responsible person, people with the permission to manage internal controls receive the task Assign responsible person. The same applies to Remediate deficiency: define measure as long as a deficiency has not been remediated.
  • Effective executions count as evidence for the mapped requirements. A deficiency can mean that a requirement reported as implemented has to be reviewed again.
  • Internal controls appear in the management review, see Preparing and conducting the management review.

Frequently asked questions

Can I delete an internal control?

Only as long as it has no executions. Otherwise, click Deactivate: the internal control is no longer due, executions and evidence are kept. With Activate, you turn it on again.

On the page of a risk, under “Ongoing treatment”, you use Assign internal control to assign internal controls that monitor the risk. This lets you see there whether the monitoring is working, see Reporting, reviewing and treating risks.

What is the difference from recurring measures?

A recurring measure is something you do regularly, for example a data backup. An internal control checks whether something works, for example whether the data backup can be restored. See Implementing and evidencing measures.