Performance evaluation
9.2
Internal audit
Audit the BCMS internally on a planned basis, and run the audit programme that makes those audits objective, competent and consequential.
What the baseline asks
Audit the BCMS internally on a planned basis, and run the audit programme that makes those audits objective, competent and consequential.
What it means when the service runs in the cloud
Internal audit should be able to follow a critical service from the business activity through the provider to the evidence. If the audit stops at the contract, the cloud part of the system has not been audited.
Evidence an auditor or a customer asks for
- Audit programme and completed audit reports
- Auditor independence evidence
- Findings tracked to closure
Common gaps in a cloud estate
- Audits performed by the people who run the BCMS
- Programme planned but not completed, with deferrals unescalated
- Findings closed on assertion rather than on verified action
Done well, what the file shows
Done well, this clause leaves a audit programme and completed audit reports that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Check the audit programme includes at least one provider-dependent service end to end.