ISO/IEC 27001:2022 Internal Audit Report
Demo Company Ltd — Information Security Management System
Executive summary
This report documents the findings of the internal audit conducted at Demo Company Ltd against the requirements of ISO/IEC 27001:2022. The audit was performed by InternalCheck, an external party with no operational involvement in Acme's information security management system (ISMS), satisfying the impartiality requirement of clause 9.2.2(c).
The audit covered all clauses of ISO/IEC 27001:2022 (clauses 4 through 10) and the 93 controls of Annex A as referenced in the auditee's Statement of Applicability (SoA), version 2.4 dated 02 March 2026. Evidence was reviewed via read-only access to Acme's Vanta tenant, supplemented by sampled interviews and document inspection.
Overall conclusion. The ISMS is broadly conformant with ISO/IEC 27001:2022. The audit identified one major nonconformity, three minor nonconformities, and five opportunities for improvement. The major nonconformity relates to incomplete documented evidence of management review outputs (clause 9.3.3). The minor findings relate to access review cadence, supplier risk assessment timeliness, and incident classification consistency.
None of the findings indicate a fundamental breakdown of the ISMS. The major nonconformity is procedural and is addressable within the standard 30-day window typically afforded by certification bodies for stage 2 or surveillance audits.
Scope, criteria & objectives
Audit scope
The scope of this internal audit is aligned with the documented ISMS scope of Demo Company Ltd as defined in its scope statement (DOC-ISMS-001, v1.3):
ISMS scope statement (verbatim)
"The design, development, hosting, and support of Acme's cloud-based [SaaS product line], including all corporate functions supporting these activities, conducted from the company's UK head office and remote employees within the United Kingdom and the European Union."
Audit criteria
- ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements
- Demo Company Ltd — Statement of Applicability (SoA), v2.4, dated 02/03/2026
- Acme's documented ISMS policies, procedures, and records
- Acme's information security objectives for the 2026 calendar year
Audit objectives
- Determine the extent to which Acme's ISMS conforms to the requirements of ISO/IEC 27001:2022
- Determine whether the ISMS has been effectively implemented and is being maintained
- Identify nonconformities, opportunities for improvement, and areas of good practice
- Provide management with information to support continual improvement of the ISMS
Out of scope
The following were explicitly excluded from this internal audit, in line with the documented ISMS scope: physical security of customer-managed environments, cloud infrastructure operated and audited by AWS under shared-responsibility, and any non-UK/EU subsidiary operations.
Audit methodology
The audit was conducted using a risk-based, evidence-led approach. Sampling was applied where populations of records (e.g. starters/leavers, change requests, supplier reviews) made full inspection impractical.
Audit activities
- Document review. 47 ISMS documents inspected, including policies, procedures, registers, and records, retrieved from the Vanta documentation library and supporting Google Drive folders.
- Evidence sampling. Risk-based samples drawn from 12 control populations, including access reviews (sample of 8 from a population of 41), starter/leaver records (sample of 6 from 14), and change requests (sample of 10 from 87).
- Interviews. Four sampled interviews conducted via video call: Information Security Manager, Head of Engineering, People Operations Lead, and a randomly sampled engineer.
- System inspection. Read-only walkthrough of Vanta dashboards, AWS IAM (via screen-share), and the corporate SSO admin console.
Finding classification
- Major nonconformity. A failure to fulfil a requirement of ISO/IEC 27001:2022 that compromises the ability of the ISMS to achieve its intended outcomes, or the absence/total failure of an entire process.
- Minor nonconformity. A single observed lapse in conforming to a requirement which does not, in isolation, undermine the effectiveness of the ISMS.
- Opportunity for improvement (OFI). An observation that does not constitute a nonconformity but where, in the auditor's judgement, the ISMS could be strengthened.
Quality assurance
This report was subject to a structured two-stage quality review prior to issue: a methodology and evidence pass, and a separate findings classification and language consistency pass. Both reviews are recorded internally against report reference IC-2026-0418.
Findings at a glance
The table below lists every finding raised during this audit. Detailed entries follow in section 05.
| ID | Clause / Control | Type | Summary |
|---|---|---|---|
| F-01 | 9.3.3 | Major NC | Management review outputs not consistently documented across the last three reviews. |
| F-02 | A.5.18 | Minor NC | Quarterly access reviews overdue for two of eight sampled production systems. |
| F-03 | A.5.19 | Minor NC | Annual supplier risk reassessment not performed for three of nine critical suppliers. |
| F-04 | A.5.24 | Minor NC | Inconsistent severity classification across two recent security incidents. |
| F-05 | 7.3 | OFI | Security awareness content has not been refreshed since onboarding rollout. |
| F-06 | A.8.16 | OFI | Monitoring alert thresholds for the staging environment are looser than production without documented rationale. |
| F-07 | A.5.30 | OFI | Business continuity testing has been conducted but lessons-learned not recorded in the ISMS. |
| F-08 | 6.1.3 | OFI | Risk treatment plan would benefit from explicit residual risk owners. |
| F-09 | A.6.3 | OFI | Onboarding training completion records would benefit from automated reminders. |
Detailed findings
Management review outputs not consistently documented
Quarterly access reviews overdue on production systems
Annual supplier risk reassessment overdue for critical suppliers
Inconsistent severity classification across recent incidents
Security awareness content not refreshed since rollout
Alert thresholds differ between staging and production without documented rationale
Business continuity testing conducted but lessons not formally recorded
Residual risks would benefit from explicit owners
Onboarding training completion would benefit from automated reminders
Clause & control coverage matrix
The matrix below summarises the audit's coverage of ISO/IEC 27001:2022 clauses. A complete control-by-control matrix for all 93 Annex A controls is provided in Appendix A of the full report (omitted from this sample for brevity).
| Clause | Title | Status | Findings |
|---|---|---|---|
| 4 | Context of the organisation | Conformant | — |
| 5 | Leadership | Conformant | — |
| 6.1.2 | Risk assessment | Conformant | — |
| 6.1.3 | Risk treatment | OFI | F-08 |
| 6.2 | Information security objectives | Conformant | — |
| 7.2 | Competence | Conformant | — |
| 7.3 | Awareness | OFI | F-05 |
| 7.5 | Documented information | Conformant | — |
| 8.1 | Operational planning and control | Conformant | — |
| 8.2 | Risk assessment (operational) | Conformant | — |
| 8.3 | Risk treatment (operational) | Conformant | — |
| 9.1 | Monitoring, measurement, analysis & evaluation | Conformant | — |
| 9.2 | Internal audit | Conformant | — |
| 9.3 | Management review | Major NC | F-01 |
| 10.1 | Continual improvement | Conformant | — |
| 10.2 | Nonconformity & corrective action | Conformant | — |
Conclusion & sign-off
Demo Company Ltd's ISMS is broadly conformant with the requirements of ISO/IEC 27001:2022. The findings raised in this report are addressable and do not indicate fundamental weaknesses in the ISMS. The major nonconformity (F-01, management review outputs) is procedural and can be remediated through adoption of a structured review template and a backfill exercise.
It is recommended that:
- Corrective actions for F-01 through F-04 be planned and tracked in the corrective action register, with target completion no later than 30 days from the date of issue of this report.
- The five opportunities for improvement be considered at the next management review and addressed where they support the 2026 information security objectives.
- A revisit be scheduled following remediation of the major and minor findings to verify closure.