Internal audit
Audit the BCMS on a planned basis with objective, competent auditors, and run the programme so findings are tracked to verified closure.
01What applies
Audit the BCMS internally on a planned basis, and run the audit programme that makes those audits objective, competent and consequential. The programme has to consider the importance of the processes and the results of previous audits, define the criteria and scope of each audit, select auditors who are objective and impartial, and ensure results are reported to relevant management. Findings are tracked to closure, with verification rather than assertion. The clause expects a programme, not a single annual audit, and it expects the process view to be auditable.
02Why it matters
Internal audit is the organization's own early warning. When it is done by the people who run the BCMS, it is not a warning at all. The clause gives the organization a way to test the process model: sample the processes, not only the clauses, and check the handoffs that the model depends on. The programme is also the place to notice that a process has quietly stopped.
03What good looks like
Build a three-year programme with process sampling and a rationale. Use auditors independent of the area. Write the audit criteria from the process definitions and the clause set. Report findings with evidence and a due date. Verify closure by looking at the action, not the note. Read the programme at the management review.
04Evidence an auditor asks for
Ask who audited the BIA process last time and what they sampled. If the auditor also owns the process, the audit is not independent.
| Evidence | The record |
|---|---|
| Programme | Audit programme with scope, criteria and sampling rationale |
| Reports | Completed audit reports with evidence-based findings |
| Independence | Auditor independence and competence evidence |
| Closure | Findings tracked to verified closure |
05Where it commonly fails
- Audits performed by the people who run the BCMS
- Programme planned but not completed, with deferrals unescalated
- Findings closed on assertion rather than verified action
06What to do before the estimate
Write the next audit around three processes and their handoffs. Name an auditor from outside the process.