A certification auditor reads the internal audit report to judge two things: whether the audit was done properly, and whether the ISMS works. A report that answers both contains six elements.
- Scope and criteria: which parts of the ISMS were audited and against what, for example ISO 27001:2022 clauses 4 to 10 and the Annex A controls in version 3 of the Statement of Applicability.
- Auditor, dates and method: who audited, when and how, including the interviews held and the samples taken.
- Findings: each one stated against the requirement it does not meet, with the evidence seen and a grade of major, minor or observation. A well-written finding reads like this: "Annex A 5.18, access rights: the access policy requires quarterly reviews; only one review, in March, was recorded in the last 12 months."
- Conformity: a summary of what was checked and found in order, so the report shows the whole picture.
- Corrective actions: for each finding the planned action, owner and deadline, or a reference to the corrective action log.
- Competence and impartiality: one sentence stating both, with the auditor's certificate kept on file.
Clause 9.2 also requires the results to be reported to relevant management. A one-page summary at the front, with the number of findings by grade and the three most important ones, covers that and gives leadership something concrete for the management review.