Plan and record your internal audits: clause-by-clause questions, Annex A sampling and auditor-style findings classification.
Clauses 4-10 questions plus Annex A sampling sheet · Excel (.xlsx) · Free, no email required
A four-sheet workbook: audit details, 23 plain-English audit questions covering every mandatory clause (4 to 10), a sampling sheet listing all 93 Annex A controls, and usage guidance. Findings are classified the way certification auditors classify them: Major NC, Minor NC, OFI.
| Sheet | Covers |
|---|---|
| Audit details | Reference, date, auditor independence, scope and areas covered |
| Clauses 4–10 | Context, leadership, planning, support, operation, performance evaluation, improvement |
| Annex A sample | All 93 controls with sampled / conformity / evidence columns |
Anyone competent and independent of the area being audited: a manager from another function, or an external contractor. The person who built the ISMS should not audit their own work.
At planned intervals. Most small businesses run one full internal audit annually, a couple of months before the external audit so findings can be closed first.
No. Clauses 4-10 must be covered, but Annex A controls can be sampled, provided every applicable control is covered across your audit cycle, typically one to three years.
ISOvault keeps your controls, evidence and corrective actions linked and dated, so internal audits start from live records instead of a hunt through shared drives. 14 days free, no card required.