The purpose of this topic is to convey how to perform Internal Audits on organization's information security management system based on ISO/IEC 27001 standard. Main points covered: • What is Internal Audit? • What is the purpose of Internal Audit? • Best practices to perform ISO 27001:2013 Information Security Management System Internal Audit Presenter: Mr. Chandra Mohan Govindarajula’s record includes 16 years of working experience as an Implementer, Lead Auditor, and QA & QC. Chandra has worked in some big companies such as a Lead Auditor and Technical expert in TUV India Private Limited, a Team Manager in Splash Tech Labs, a Process Associate in GE Capital International and so on. He has an M.sc Degree in Information Technology, and some of the many certificates that he holds are ISO 22301, PCI DSS, ISO 9001 and ISO 27001, ISO 31000, ISO 14001, ISO 18001 and ISO/IEC 20000. Link of the recorded session published on YouTube: https://youtu.be/YJdLS7YYkKw

2. Chandra Mohan Govindarajula
Job Positions
Mr. Chandra Mohan Govindarajula’s record includes 16 years of working
experience as an Implementer, Lead Auditor, and QA & QC. Chandra has
worked in some big companies such as a Lead Auditor and Technical expert in
TUV India Private Limited, a Team Manager in Splash Tech Labs, and a
Process Associate in GE Capital International and so on. Currently, Chandra is
working as a Lead Information Security at Value Labs.
Contact Information
+919949673325 cmohang@msn.com
https://in.linkedin.com/in/chandra-mohan-govindarajula-1726ab7
www.valuelabs.com

3. Internal Audit – ISO 27001 : 2013
Information Security Management System
1. Audit definitions
2. Planning and preparation for the audit
3. Conducting audit
4. Report the audit findings
5. Audit closure
6. Questions
3

4. “Systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to
determine the extent to which the audit criteria are fulfilled”
Note 1 to entry: An audit can be an internal audit (first party) or an external audit
(second party or third party) and it can be combined audit (combining two or more disciplines)
Audit Evidence - records, statements of fact or other information which are relevant to the audit criteria
and verifiable
NOTE Audit evidence can be qualitative or qualitative
Audit Criteria - set of policies, procedures or requirements used as a reference against which audit evidence
is comparted
Auditor – Person who is qualified to perform the audit
Auditee – the organization/ function that is being audited
Source - ISO/IEC 27000 - Information technology - Security techniques - Information security management systems - Overview and vocabulary; ISO 9000:2005,
definition 3.9.4
Audit Definitions
4

5. 5
Objective Evidence : Data supporting the existence or verify of something
NOTE Objective evidence may be obtained through observation, measurement, test, or other means
Observation : A statement of fact made during an audit and substantiated by objective evidence
Non-conformity : Non-fulfilment of a requirement
Audit purpose :
• To collect objective evidence to permit an information judgment about status of Information security
management system
• To evaluate the need for improvement or corrective action
• Audit action is a fact finding exercise and not a fault finding exercise
Audit Objective :
• To verify whether
• System is adequately defined (Confirms to ISO 27001:2013 ISMs and organization requirements)
• Defined system is implemented
• Implement system is effective
Source - ISO/IEC 27000 - Information technology - Security techniques - Information security management systems - Overview and vocabulary; ISO 9000:2005,
definition 3.9.4
Audit Definitions

6. 6
Responsibilities of Internal Auditor
• Complying with acceptable audit requirements
• Communicating and clarifying audit requirements
• Planning and carrying out assigned responsibilities effectively and efficiently
• Documenting the observations and reporting audit results
• Retaining and safeguarding documents pertaining to audit
• Co-operating with and supporting lead auditor
• Being open-minded and mature
Responsibilities of Auditee
• Inform relevant employees about the scope of audit
• Provide access to facilities and evidences as requested by auditor
• Be prepared to face audit as per schedule
• Attend opening and closing meetings
• Co-Operate with auditor
• Determine and initiate corrective actions based on audit reports
Planning and Preparation for Audit

7. 7
Audit Skills
• Communicating – Oral, Written
• Tactful / Flexible / Persistent
• Time management
• Fact finding – Listening, Observing, questioning, sampling
• Examination / Tracing
• Judgement / Objectivity
• Integrity
Human aspects in audits
• Develop interest with sincerity and friendliness
• Be careful in giving advice
• Recognize that people hear what they want to
• Listen to understand
• Be sensitive to feelings, attitudes and motives
• Respond in a neutral manner
• Repeat or rephrase what they said
Planning and Preparation for Audit

8. 8
Auditee reactions
• Volunteered information – results in particular line of investigation
• Diversionary tactics
• Arguments
• Active co-operation
• Challenging
Audit Planning
• Objectives and scope of audit
• Focus areas of audit
• Audit schedule
• Audit team (s)
• Reference documentation
• Audit Preparation
• Auditor
• Study the audit objectives, scope, and focus areas
• Study the function/project – current status
• Study previous audit reports
• Prepare audit checklist / worksheet
• Auditee
• Organize for and be prepared to face scheduled audit
Planning and Preparation for Audit

9. 9
Audit checklist
• Keeps audit objectives clear
• Evidence of planning
• Maintains audit pace and continuity
• Reduces auditor bias
• Reduces work road during audit
• Reduces audit sample
• “There is no ideal checklist ! “
Conducting audit
Opening Meeting
• Company management, Auditee, Lead auditor, and Auditors
• Review the scope of the audit cycle
• Clarify and reconfirm the audit schedule
• Confirm resources and facilities needed for audit are available
• Explain audit process
Planning and Preparation for Audit

10. 10
• Audit Process
• Initiation
• Investigation and Verification
• Identification
• Reporting
• Audit Techniques
• Sampling
• Interviewing
• Tracing
Audit Sampling
• Audit Sampling
• Audit is a sampling exercise
• Samples taken need to be representative
• Sample size typically varies (3 – 12 )
• Samples have to be selected at random by the auditor
• The result is unbiased, objective, defensible and repeatable
Conducting Audit

11. 11
Interviewing
• Ask right questions
• Put people at ease – audit a constructive exercise
• Explain your purpose
• Find out what Auditee is doing
• Analyse what Auditee is doing
• Make tentative conclusions
• Explain next steps
• Exhibit professionalism
Tracing
• Used to collect evidence during the audit
• Could involve almost every facet of the system
• Results in well defined picture of the actual practices
• Mechanisms of tracing
• Transaction sequence
• Date sequence
• Task sequence
Verification
• Examine documents
• Collect all the evidence – documents, records, plans, ….
• Check “actual practices” against “defined process”
• Make notes of what you see
• Make notes of discrepancies
Conducting Audit

12. 12
Taking Notes
• As a reference
• As objective evidence
• Admissible statements
• Documents numbers and revisions
• Other information
Identifying problems
• Focus on the factors critical to quality
• Decide whether or not Auditee is in control
• Consider if there are further symptoms
• Could this minor problem be a symptom of a fatal condition?
• Where in the process could be the root cause lie?
• Always verify evidence of non-compliance
• Audit Observations
• List problems (possible non-conformities) identified along with objective evidence
• Keep the Auditee informed
• Audit Closure
• Thank the Auditee and their team
• De-brief the Auditee (need not tell which is NC, but summarize the findings)
• Close the audit
Conducting Audit

13. 13
Audit findings
• Facts acknowledged by the Auditee at the time they are found using only objective evidence
• Where was non-conformity observed?
• Why it is a non-conformity?
• Who was involved (only when non-conformity is based on admissible spoken evidence)?
Non-conformity (NC)
• Minor
• An isolated, witnessed incident or failure to comply with a procedure or Information security
management system requirements. A minor problem that warrants attention
• Major
• A significant non-conformity with the requirements of the ISO 27001 standard
• A failure of a complete system or the lack of Information security management system requirements
Reporting Audit Findings

14. 14
Reporting audit findings
Non-conformity reporting
• The objective of non-conformity writing is to get effective corrective action
• Complete and accurate non-conformity statements help in casual analysis
• Non-conformity description can be short but should contain all relevant facts
Audit report
• Audit information
• General observations
• Non-conformities
• Improvement opportunities
Reporting Audit Findings
Example of Non-conformity:
What – What was found?
Where – Where it was found?
Why - Why it is a non-conformity?
What – Disciplinary process is not evidenced
Where – While performing Human Resource department of PECB at conference hall, Auditee was “Mr Ali”
Why – ISO 27001: 2013 – Information security management system requirements - Control A.7.2.3 says “There shall
be a formal and communicated disciplinary process in place to take action against employees who have committed
an information security breach”

15. 15
• Closure of non- conformities
• Closure action – action taken to correct the non-conformity (where possible)
• Closure action to be implemented by Auditee
• Closure action to be verified by Auditor
• Causal analysis of non-conformity:
• Cause/effect analysis – Cause category, control failure
• Corrective action – function/project level, organization level
Audit closure

16. 16
• Audit report preparation
• Summary of audit planned and conducted
• Analysis of audit coverage and non-conformities
• Recurrence of non-conformities
• Corrective action plan and schedule
• Closing Meeting
• Participants – Top management, Auditee’s, auditors and Lead auditor
• Audit report distribution
• Agree on corrective action plan
Audit closure

17. THANK YOU
?
QUESTIONS?
Contact Information
+919949673325 cmohang@msn.com
https://in.linkedin.com/in/chandra-mohan-govindarajula-1726ab7
www.valuelabs.com