After an ISO 27001 internal audit you should hold five documents. The certification auditor asks for them at Stage 1 and again at each surveillance audit.
- Audit programme. The multi-year schedule of which parts of the ISMS are audited when and by whom. Clause 9.2.2 requires it, and it belongs to you even when an outside firm does the audit.
- Audit plan. The plan for this particular audit: scope, criteria, dates, the auditor's name and the people interviewed. Clause 9.2.2 asks you to define the scope and criteria of each audit, and this is where they are written down.
- Audit report. Every finding with the requirement it fails, the evidence seen and a grade, plus a summary of what was found to conform.
- Corrective action log. One line per finding with the correction, root cause, corrective action, owner, deadline and the evidence it was closed. Clause 10.2 is the requirement behind it.
- Competence and impartiality record. The auditor's training certificate or CV, and a short statement that they did not audit their own work. Clause 7.2 covers competence, and Clause 9.2.2 the impartiality.
Keep all five in one folder. At Stage 1 the auditor often asks for them in a single request, and a complete set answers several questions before they come up.