Percerno Skillsbeta
← everything it can do · compliance

Isms Audit Expert TEXT

Performs ISO 27001 ISMS audit planning, control assessment, and finding management. It generates risk-based audit schedules, documents nonconformities, and prepares Stage 1/Stage 2 certification evidence.

7 uses this weeksource alirezarezvanilicence MIT
Quality gate: PASS · better answers · measured 2026-10-23
Blind-judged against the bare model on 2 requests: average lift +1.5 points (specificity, structure, method, fit).
won 1/2, lift +1.5, tokens ×70.55
Security scan: clean · 2026-10-24 · 6 files · ran in sandbox
no network calls, shell tricks, credential access or instruction tampering found in its files.

Try asking

Say it in your own words; the assistant finds this recipe by itself. Examples:

“Lav en auditplan baseret på vores seneste risikovurdering.”
“Hvordan dokumenterer vi overholdelse af kontrol A.8.13 i vores ISMS?”
“Jeg har brug for en skabelon til at rapportere alvorlige afvigelser.”
“Create a risk-based audit plan for 2024 focusing on high-risk controls.”
“I found that access reviews are not documented. How do I classify this nonconformity?”
“Prepare a checklist for the Stage 1 audit documentation review.”
Try this skill from Claude, ChatGPT or a chat on your own page. Free plan, no credit card.Get started free

Good for

iso-27001isms-auditcomplianceannex-agap-analysisnonconformitysecurity-controlscertificationrisk-assessment

Not for

Do not use for general cybersecurity penetration testing, vulnerability scanning, or technical exploit analysis, as this skill focuses on management system compliance and documentation rather than technical security operations. It is not for GDPR privacy impact assessments unless specifically tied to ISMS control mapping.

Details

When it is the right choice

Use when the user needs to plan an internal or external ISMS audit, assess the implementation status of Annex A controls, or prepare for ISO 27001 certification stages. It is also appropriate for documenting audit findings, classifying nonconformities, and managing corrective action workflows.

The full recipe the assistant reads

ISMS Audit Expert

Internal and external ISMS audit management for ISO 27001 compliance verification, security control assessment, and certification support.

Table of Contents

Audit Program Management

Risk-Based Audit Schedule

Risk Level Audit Frequency Examples
Critical Quarterly Privileged access, vulnerability management, logging
High Semi-annual Access control, incident response, encryption
Medium Annual Policies, awareness training, physical security
Low Annual Documentation, asset inventory

Annual Audit Planning Workflow

  1. Review previous audit findings and risk assessment results
  2. Identify high-risk controls and recent security incidents
  3. Determine audit scope based on ISMS boundaries
  4. Assign auditors ensuring independence from audited areas
  5. Create audit schedule with resource allocation
  6. Obtain management approval for audit plan
  7. Validation: Audit plan covers all Annex A controls within certification cycle

Auditor Competency Requirements

  • ISO 27001 Lead Auditor certification (preferred)
  • No operational responsibility for audited processes
  • Understanding of technical security controls
  • Knowledge of applicable regulations (GDPR, HIPAA)

Audit Execution

Pre-Audit Preparation

  1. Review ISMS documentation (policies, SoA, risk assessment)
  2. Analyze previous audit reports and open findings
  3. Prepare audit plan with interview schedule
  4. Notify auditees of audit scope and timing
  5. Prepare checklists for controls in scope
  6. Validation: All documentation received and reviewed before opening meeting

Audit Conduct Steps

  1. Opening Meeting
  2. Confirm audit scope and objectives
  3. Introduce audit team and methodology

  4. Agree on communication channels and logistics

  5. Evidence Collection

  6. Interview control owners and operators
  7. Review documentation and records
  8. Observe processes in operation

  9. Inspect technical configurations

  10. Control Verification

  11. Test control design (does it address the risk?)
  12. Test control operation (is it working as intended?)
  13. Sample transactions and records

  14. Document all evidence collected

  15. Closing Meeting

  16. Present preliminary findings
  17. Clarify any factual inaccuracies
  18. Agree on finding classification

  19. Confirm corrective action timelines

  20. Validation: All controls in scope assessed with documented evidence

Control Assessment

Control Testing Approach

  1. Identify control objective from ISO 27002
  2. Determine testing method (inquiry, observation, inspection, re-performance)
  3. Define sample size based on population and risk
  4. Execute test and document results
  5. Evaluate control effectiveness
  6. Validation: Evidence supports conclusion about control status

For detailed technical verification procedures by Annex A control, see security-control-testing.md.

Finding Management

Finding Classification

Severity Definition Response Time
Major Nonconformity Control failure creating significant risk 30 days
Minor Nonconformity Isolated deviation with limited impact 90 days
Observation Improvement opportunity Next audit cycle

Finding Documentation Template

Finding ID: ISMS-[YEAR]-[NUMBER]
Control Reference: A.X.X - [Control Name]
Severity: [Major/Minor/Observation]

Evidence:
- [Specific evidence observed]
- [Records reviewed]
- [Interview statements]

Risk Impact:
- [Potential consequences if not addressed]

Root Cause:
- [Why the nonconformity occurred]

Recommendation:
- [Specific corrective action steps]

Corrective Action Workflow

  1. Auditee acknowledges finding and severity
  2. Root cause analysis completed within 10 days
  3. Corrective action plan submitted with target dates
  4. Actions implemented by responsible parties
  5. Auditor verifies effectiveness of corrections
  6. Finding closed with evidence of resolution
  7. Validation: Root cause addressed, recurrence prevented

Certification Support

Stage 1 Audit Preparation

Ensure documentation is complete: - [ ] ISMS scope statement - [ ] Information security policy (management signed) - [ ] Statement of Applicability - [ ] Risk assessment methodology and results - [ ] Risk treatment plan - [ ] Internal audit results (past 12 months) - [ ] Management review minutes

Stage 2 Audit Preparation

Verify operational readiness: - [ ] All Stage 1 findings addressed - [ ] ISMS operational for minimum 3 months - [ ] Evidence of control implementation - [ ] Security awareness training records - [ ] Incident response evidence (if applicable) - [ ] Access review documentation

Surveillance Audit Cycle

Period Focus
Year 1, Q2 High-risk controls, Stage 2 findings follow-up
Year 1, Q4 Continual improvement, control sample
Year 2, Q2 Full surveillance
Year 2, Q4 Re-certification preparation

Validation: No major nonconformities at surveillance audits.

Tools

scripts/

Script Purpose Usage
isms_audit_scheduler.py Generate risk-based audit plans python scripts/isms_audit_scheduler.py --year 2025 --format markdown

Audit Planning Example

# Generate annual audit plan
python scripts/isms_audit_scheduler.py --year 2025 --output audit_plan.json

# With custom control risk ratings
python scripts/isms_audit_scheduler.py --controls controls.csv --format markdown

References

File Content
iso27001-audit-methodology.md Audit program structure, pre-audit phase, certification support
security-control-testing.md Technical verification procedures for ISO 27002 controls
cloud-security-audit.md Cloud provider assessment, configuration security, IAM review

Audit Performance Metrics

KPI Target Measurement
Audit plan completion 100% Audits completed vs. planned
Finding closure rate >90% within SLA Closed on time vs. total
Major nonconformities 0 at certification Count per certification cycle
Audit effectiveness Incidents prevented Security improvements implemented
Files in this skill (7)
  • LICENSE
  • SKILL.md
  • references/cloud-security-audit.md
  • references/iso27001-audit-methodology.md
  • references/iso27001_audit_playbook.md
  • references/security-control-testing.md
  • scripts/isms_audit_scheduler.py
Where it comes from

Vendored from alirezarezvani/claude-skills, commit 27cfcd0fb0a4, path ra-qm-team/skills/isms-audit-expert, licence MIT. The upstream licence file ships inside the skill.