Chapter 30 — Management systems and audit
Lesson map
Lesson 30 published. Map, example, EX088.
flowchart TD
N0["Learning outcomes"]
N1["30.1 Management system"]
N2["30.2 Internal audit"]
N3["30.3 Findings"]
N4["30.4 Continual improvement"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX088"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["30.1 Management system"]
N2["30.2 Internal audit"]
N3["30.3 Findings"]
N4["30.4 Continual improvement"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX088"]
[Learning outcomes]
|
v
[30.1 Management system]
|
v
[30.2 Internal audit]
|
v
[30.3 Findings]
|
v
[30.4 Continual improvement]
|
v
[Worked example] --> [Exercise EX088]
Learning outcomes
You will (1) describe an information security management system; (2) prepare for an internal audit; (3) handle audit findings.
30.1 Management system
Aisha learns that ISO/IEC 27001:2022 describes an information security management system: a set of policies, processes and responsibilities that an organisation uses to manage information security risks and improve over time. It requires understanding context, leadership commitment, risk assessment and treatment, support, operation, performance evaluation and improvement. Ashfield is not seeking certification, but its board wants to use the structure to organise its work. Aisha maps Ashfield's existing documents to the main clauses and finds that performance evaluation and improvement are the weakest areas.
30.2 Internal audit
Aisha joins Ashfield's first internal audit of security, led by an external accountant who audits other areas. They check whether policies are followed, using samples. For access control, they select ten leavers and check whether accounts were disabled within one day. Eight were; two took a week. Dr. Carrow notes that audits test whether practice matches policy, which is different from checking whether a policy exists. The accountant records the result with the names of the two leavers and the dates their accounts were disabled.
30.3 Findings
The audit produces four findings: late leaver removal, missing change records, untested recovery for one system and no review of supplier access. Each finding states the requirement, evidence and risk. Aisha helps managers write action plans with owners and dates. She learns that findings are opportunities to improve, and that defensive responses waste time better spent fixing the issues identified. The board reviews the findings and action plans at its next meeting and asks the IT manager to report progress each quarter until all four findings are closed.
30.4 Continual improvement
The management system includes continual improvement: lessons from audits, incidents and measures feed back into policies and controls. Aisha suggests a quarterly security meeting where the IT manager, compliance officer and head of operations review measures, findings and incidents, and decide actions. Dr. Carrow explains that this cycle, plan, do, check and act, keeps security responsive to change rather than frozen at the moment policies were written. The first meeting takes an hour and produces five actions, each with an owner and date.
Worked example
Aisha studies ISO/IEC 27001's management system structure, joins an internal audit finding late leaver removal, helps plan actions and sets a quarterly review meeting.
Synthetic case. The audit is synthetic.
Errors and limits
Checking that a policy exists is not the same as checking it is followed.
Exercises
- EX088 — Sample result. How many sampled leavers were removed within a day? Rubric: 3 = eight of ten;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX089 — Audit finding. Name one audit finding. Rubric: 3 = no review of supplier access;; 2 = one;; 1 = vague;; 0 = none.
- EX090 — Improvement cycle. What cycle keeps security responsive? Rubric: 3 = plan, do, check, act;; 2 = partly correct;; 1 = other;; 0 = none.
Continue studying — lesson 30 (chapter 30 of 40)
← Chapter 29 · Course chapter index · Chapter 31 →
Continue to the next authored lesson.