isms-audit-expert

name	isms-audit-expert
description	Manage — Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support. Use when the user mentions
triggers	["ISMS audit","ISO 27001 audit","security audit","internal audit ISO 27001","security control assessment","certification audit","surveillance audit","audit finding","nonconformity"]
executor	HYBRID
skill_id	business.ra-qm-team.isms-audit-expert
status	ADOPTED
security	{"level":"high","pii":false,"approval_required":true}
anchors	["business","customer_success","compliance","security"]
tier	2
input_schema	[{"name":"code_or_task","type":"string","description":"Code snippet, script, or task description to process","required":true}]
output_schema	[{"name":"result","type":"object","description":"Result from the automated action"},{"name":"status","type":"string","description":"Execution status: success | partial | failure"}]

ISMS Audit Expert

Internal and external ISMS audit management for ISO 27001 compliance verification, security control assessment, and certification support.

Table of Contents

• Audit Program Management
• Audit Execution
• Control Assessment
• Finding Management
• Certification Support
• Tools
• References

---

Audit Program Management

Risk-Based Audit Schedule

Risk Level	Audit Frequency	Examples
Critical	Quarterly	Privileged access, vulnerability management, logging
High	Semi-annual	Access control, incident response, encryption
Medium	Annual	Policies, awareness training, physical security
Low	Annual	Documentation, asset inventory

Annual Audit Planning Workflow

1. Review previous audit findings and risk assessment results
2. Identify high-risk controls and recent security incidents
3. Determine audit scope based on ISMS boundaries
4. Assign auditors ensuring independence from audited areas
5. Create audit schedule with resource allocation
6. Obtain management approval for audit plan
7. Validation: Audit plan covers all Annex A controls within certification cycle

Auditor Competency Requirements

• ISO 27001 Lead Auditor certification (preferred)
• No operational responsibility for audited processes
• Understanding of technical security controls
• Knowledge of applicable regulations (GDPR, HIPAA)

---

Audit Execution

Pre-Audit Preparation

1. Review ISMS documentation (policies, SoA, risk assessment)
2. Analyze previous audit reports and open findings
3. Prepare audit plan with interview schedule
4. Notify auditees of audit scope and timing
5. Prepare checklists for controls in scope
6. Validation: All documentation received and reviewed before opening meeting