A key audit process is the way auditors gather information and determine the findings' characteristics.

Determine source of information

Collect by means of appropriate sampling

Reviewing

Audit evidence

Evaluating against audit criteria

Audit findings

Audit conclusions

The reviewing step involves checking the accuracy, completeness, and relevance of the collected information. The audit evidence step involves documenting the information in a verifiable and traceable manner. The evaluating against audit criteria step involves comparing the audit evidence with the requirements of the ISO 27001 standard and the organization’s own policies and objectives. The audit findings step involves identifying any nonconformities, weaknesses, or opportunities for improvement in the ISMS. The audit conclusions step involves summarizing the audit results and providing recommendations for corrective actions or enhancements.