{ "schemaVersion": "artifactExample.v2", "artifactId": "IAPC", "title": "Internal Audit Program & Checklist", "definitionRef": { "artifactId": "IAPC", "definitionSchemaVersion": "artifactDefinition.v2", "definitionId": "IAPC.artifactDefinition.v2", "title": "Internal Audit Program & Checklist" }, "organization": "Arcfield", "sections": [ { "id": "title_page", "title": "Title Page", "values": { "Document Title": "Internal Audit Program & Checklist", "Document ID": "IAPC-CHK-001", "Version": "1.1", "Status": "Approved", "Organization": "Arcfield", "Owner": "ISMS Manager", "Approver": "Top Management", "Classification": "Internal", "Effective Date": "2026-09-11", "Next Review Date": "2027-09-11" }, "items": [ "Document Title: Internal Audit Program & Checklist", "Document ID: IAPC-CHK-001", "Version: 1.1", "Status: Approved", "Organization: Arcfield", "Owner: ISMS Manager", "Approver: Top Management", "Classification: Internal", "Effective Date: 2026-09-11", "Next Review Date: 2027-09-11" ], "contentType": "metadata" }, { "id": "abstract", "title": "Abstract", "text": "This example defines a Q3 internal audit program and execution checklist for selected ISO/IEC 27001 clauses and Annex A controls. It demonstrates scope, criteria, independence, sampling rationale, audit tests, findings, follow-up and final audit conclusion. This checklist tests whether the 11 September 2026 freeze is complete for the surveillance cycle after certificate ARC-ISMS-2025-001.", "contentType": "narrative" }, { "id": "document_control", "title": "Document Control", "contentType": "control_table" }, { "id": "change_log", "title": "Revision history", "groups": [ { "text": "A published change is a new row. Do not edit an approved version in place." }, { "rows": [ { "Version": "1.0", "Date": "2026-08-29", "Change": "Initial Arcfield Platform publication.", "Approved by": "Top Management" }, { "Version": "1.1", "Date": "2026-09-11", "Change": "Approved Arcfield worked example after the 11 September 2026 internal audit.", "Approved by": "Top Management" } ] } ], "contentType": "revision_table" }, { "id": "instructions", "title": "Instructions", "groups": [ { "text": "Copy this file as the controlled Word master for your ISMS. The Arcfield identity fields on the cover are the approved worked example. Complete the steps below when you adopt the file for your organization." }, { "items": [ "Fill the cover identity fields (Organization, Version, Classification, Owner, Approver, Effective Date and Next Review Date) when you adopt this file. The Arcfield values shown here are the approved worked example.", "Issue your own version and a new Revision history row. Do not edit an approved version in place.", "Cite this approved version from related records. Do not copy this file into those records." ] } ], "contentType": "ordered_list" }, { "id": "audit_program", "title": "Audit program", "values": { "Audit period": "Q3 2026", "Audit scope": "Core ISMS processes and selected Annex A controls", "Criteria": "ISO/IEC 27001:2022 clauses 4-10 and selected Annex A controls", "Method": "Interviews, document review, evidence sampling and trace testing", "Lead auditor": "Internal Auditor", "Auditor independence confirmed?": "Yes", "Auditees": "ISMS Manager, IT Operations, HR Manager, Supplier Manager", "Reporting date": "2026-09-15" }, "text": "Define the real audit program scope, criteria, methods, responsibilities, independence, and reporting expectations.", "groups": [ { "id": "introduction", "heading": "What this checklist is", "level": 1, "text": "This document is Arcfield's Internal Audit Program & Checklist. Provide auditable evidence for Internal Audit Program & Checklist. It is not a methodology essay or the governing policy. This checklist applies to the Arcfield Platform (B2B SaaS for regulated fintech and health customers): production, customer data, CI/CD, privileged access and critical suppliers. Neighbouring records (AOAVC, ISO, ACM) cite this Document Control version. Do not copy these paragraphs into them." }, { "id": "scope", "heading": "Scope", "level": 1, "text": "Use this table before you copy a rule into another record or exclude a duty from this file.", "rows": [ { "In this file": "The rules, roles, worked Arcfield example and the records this file owns.", "Not in this file": "The ISMS boundary (ISS), Annex A selection (SoA) or live rows in AOAVC, ISO, ACM." }, { "In this file": "Interfaces that must cite this Document Control version, including CI/CD, identity and suppliers where they affect CIA.", "Not in this file": "Live ISS scope rows, SoA applicability decisions, or neighbouring live registers. Those files keep their own approved versions; this file does not duplicate them." } ] }, { "id": "terms", "heading": "Terms used here", "level": 1, "text": "These terms are local to this file. Expand every acronym on first use in the body.", "rows": [ { "Term": "Check ID", "Meaning": "The stable identifier for one check or question. Do not reuse an ID for a different question." }, { "Term": "Exception", "Meaning": "A time-bound, approved departure with expiry and a compensating control." }, { "Term": "CIA", "Meaning": "Confidentiality, Integrity and Availability of in-scope information and services." }, { "Term": "Document Control version", "Meaning": "The approved version cited from neighbouring records. Do not copy this body into those records." } ] }, { "id": "audit_program", "heading": "Audit program", "level": 1, "text": "Use this table for audit program in the Arcfield Platform ISMS. Define the real audit program scope, criteria, methods, responsibilities, independence, and reporting expectations. Field Value Audit period Q3 2026 Audit scope Core ISMS processes and selected Annex A controls Criteria ISO/IEC 27001:2022 clauses 4-10 and selected Annex A controls Method Interviews, document review, evidence sampling Lead auditor Internal Auditor Auditor independence confirmed? Yes Auditees ISMS Manager, IT Operations, HR Manager Reporting date 2026-09-15 Cite this Document Control version from neighbouring records.", "rows": [ { "Field": "Audit period", "Value": "Q3 2026" }, { "Field": "Audit scope", "Value": "Core ISMS processes and selected Annex A controls" }, { "Field": "Criteria", "Value": "ISO/IEC 27001:2022 clauses 4-10 and selected Annex A controls" }, { "Field": "Method", "Value": "Interviews, document review, evidence sampling" }, { "Field": "Lead auditor", "Value": "Internal Auditor" }, { "Field": "Auditor independence confirmed?", "Value": "Yes" }, { "Field": "Auditees", "Value": "ISMS Manager, IT Operations, HR Manager" }, { "Field": "Reporting date", "Value": "2026-09-15" } ] }, { "id": "validation_checklist", "heading": "Validation checklist", "level": 1, "text": "Use this table for validation checklist in the Arcfield Platform ISMS. Use this table as the main validation audit trail with one row per performed asset-owner check. Check ID Area What was validated Required? Performed by Approved by Date Result Evidence reference Notes AOAVC-001 Asset identity Asset ID AST-001, asset name Production platform, owner, custodian and lifecycle status Yes Asset Manager Service Owner 2026-08-29 Successful AI-AST-001-2026-Q3 Matches Asset Inventory. AOAVC-002 Classification Confidential classification and CIA needs for Production platform Yes Asset Owner ISMS Manager 2026-08-29 Successful CLASS-AST-001-2026-Q3 Confidentiality high, availability high. AOAVC-003 Dependencies Cloud hosting, identity provider and backup dependency links Yes IT Operations Service Owner 2026-08-29 Pending DEP-AST-001-2026-Q3 Supplier contact update pending. Cite this Document Control version from neighbouring records.", "rows": [ { "Check ID": "AOAVC-001", "Area": "Asset identity", "What was validated": "Asset ID AST-001, asset name Production platform, owner, custodian and lifecycle status", "Required?": "Yes", "Performed by": "Asset Manager", "Approved by": "Service Owner", "Date": "2026-08-29", "Result": "Successful", "Evidence reference": "AI-AST-001-2026-Q3", "Notes": "Matches Asset Inventory." }, { "Check ID": "AOAVC-002", "Area": "Classification", "What was validated": "Confidential classification and CIA needs for Production platform", "Required?": "Yes", "Performed by": "Asset Owner", "Approved by": "ISMS Manager", "Date": "2026-08-29", "Result": "Successful", "Evidence reference": "CLASS-AST-001-2026-Q3", "Notes": "Confidentiality high, availability high." }, { "Check ID": "AOAVC-003", "Area": "Dependencies", "What was validated": "Cloud hosting, identity provider and backup dependency links", "Required?": "Yes", "Performed by": "IT Operations", "Approved by": "Service Owner", "Date": "2026-08-29", "Result": "Pending", "Evidence reference": "DEP-AST-001-2026-Q3", "Notes": "Supplier contact update pending." } ] }, { "id": "evidence_reviewed", "heading": "Evidence reviewed", "level": 1, "text": "Use this table for evidence reviewed in the Arcfield Platform ISMS. Record the evidence reviewed to support the validation conclusion. Evidence item Source system / document Owner Date reviewed Quality result Gap identified? Evidence reference Notes Asset Inventory extract for AST-001 Asset Inventory Asset Manager 2026-08-29 Complete No AI-AST-001-2026-Q3 Owner and classification present. Access Control Matrix for Production platform Access Control Matrix IT Operations 2026-08-29 Partial Yes ACM-APP-CRM-2026-Q3 Supplier contact needs update. Cite this Document Control version from neighbouring records.", "rows": [ { "Evidence item": "Asset Inventory extract for AST-001", "Source system / document": "Asset Inventory", "Owner": "Asset Manager", "Date reviewed": "2026-08-29", "Quality result": "Complete", "Gap identified?": "No", "Evidence reference": "AI-AST-001-2026-Q3", "Notes": "Owner and classification present." }, { "Evidence item": "Access Control Matrix for Production platform", "Source system / document": "Access Control Matrix", "Owner": "IT Operations", "Date reviewed": "2026-08-29", "Quality result": "Partial", "Gap identified?": "Yes", "Evidence reference": "ACM-APP-CRM-2026-Q3", "Notes": "Supplier contact needs update." } ] }, { "id": "validation_decision", "heading": "Validation decision", "level": 1, "text": "Use this table for validation decision in the Arcfield Platform ISMS. State the final validation decision. Field Value Validation result Conditionally accepted Accepted by owner Service Owner Reviewer ISMS Manager Open blocker decision No access blocker; supplier contact update remains open Final status Conditionally complete Decision date 2026-08-29 Evidence reference AOAVC-DEC-2026-Q3 Cite this Document Control version from neighbouring records.", "rows": [ { "Field": "Validation result", "Value": "Conditionally accepted" }, { "Field": "Accepted by owner", "Value": "Service Owner" }, { "Field": "Reviewer", "Value": "ISMS Manager" }, { "Field": "Open blocker decision", "Value": "No access blocker; supplier contact update remains open" }, { "Field": "Final status", "Value": "Conditionally complete" }, { "Field": "Decision date", "Value": "2026-08-29" }, { "Field": "Evidence reference", "Value": "AOAVC-DEC-2026-Q3" } ] } ], "contentType": "field_table" }, { "id": "audit_plan", "title": "Audit plan and sampling", "groups": [ { "text": "Use this table or list as the working record. Name owners, systems and evidence so a second person can apply the same rule." }, { "rows": [ { "Audit area": "Access control", "Requirement / control": "A.5.15, A.5.18", "Sample population": "Active privileged users", "Sample size": "5 of 14", "Sampling rationale": "High-risk population and recent admin exception.", "Auditor": "Internal Auditor", "Planned date": "2026-09-03", "Evidence expected": "ACM, access approvals and access review records" }, { "Audit area": "Risk management", "Requirement / control": "6.1.2, 6.1.3, 8.2, 8.3", "Sample population": "High and medium risks", "Sample size": "6 of 18", "Sampling rationale": "Coverage of treatment decisions and residual risk.", "Auditor": "Internal Auditor", "Planned date": "2026-09-05", "Evidence expected": "Risk register, treatment plan and SoA links" }, { "Audit area": "Documented information", "Requirement / control": "7.5", "Sample population": "Controlled ISMS documents changed in Q3", "Sample size": "4 of 12", "Sampling rationale": "Recent changes before certification preparation.", "Auditor": "Internal Auditor", "Planned date": "2026-09-06", "Evidence expected": "DCP records, approvals and document register" } ] } ], "contentType": "evidence_table" }, { "id": "audit_checklist", "title": "Audit checklist", "groups": [ { "text": "Use this table or list as the working record. Name owners, systems and evidence so a second person can apply the same rule." }, { "rows": [ { "Check ID": "IAPC-CHK-001", "Area": "Access control", "Requirement": "Privileged access is approved and reviewed.", "Audit test": "Sample privileged accounts and trace approval plus review evidence.", "Evidence examined": "ACM-REVIEW-2026-08; ARR-2026-Q3", "Performed by": "Internal Auditor", "Date": "2026-09-03", "Result": "Minor nonconformity", "Finding reference": "IAPC-F-001", "Notes": "One cloud admin exception exceeded expected review period." }, { "Check ID": "IAPC-CHK-002", "Area": "Risk management", "Requirement": "Risk treatment status is tracked and evidence-linked.", "Audit test": "Trace high-risk treatment rows to evidence and residual-risk decisions.", "Evidence examined": "RR-2026-Q3; RTP-REVIEW-2026-Q3; ROAR-2026-Q3", "Performed by": "Internal Auditor", "Date": "2026-09-05", "Result": "Conforming", "Finding reference": "", "Notes": "Evidence trail is complete for sampled risks." }, { "Check ID": "IAPC-CHK-003", "Area": "Documented information", "Requirement": "Controlled documents have owner, approval and review metadata.", "Audit test": "Sample updated ISMS documents and verify approval and publication evidence.", "Evidence examined": "DCP-PUB-2026-001; DR-UPDATE-2026-08", "Performed by": "Internal Auditor", "Date": "2026-09-06", "Result": "Opportunity for improvement", "Finding reference": "IAPC-OFI-001", "Notes": "Review cadence could be clearer for supplier-specific records." } ] } ], "contentType": "evidence_log_table" }, { "id": "findings", "title": "Findings classification", "groups": [ { "text": "Use this table or list as the working record. Name owners, systems and evidence so a second person can apply the same rule." }, { "rows": [ { "Finding ID": "IAPC-F-001", "Requirement": "A.5.18 Access rights", "Classification": "Minor nonconformity", "Description": "One privileged cloud admin exception remained open beyond review expectation.", "Evidence": "ARR-2026-Q3", "Owner": "IT Operations Manager", "Due date": "2026-09-30", "Corrective action reference": "CAR-ACCESS-2026-001", "Status": "Open" }, { "Finding ID": "IAPC-OFI-001", "Requirement": "7.5 Documented information", "Classification": "Opportunity for improvement", "Description": "Supplier-specific record review cadence can be made more explicit.", "Evidence": "DR-UPDATE-2026-08", "Owner": "Supplier Manager", "Due date": "2026-10-15", "Corrective action reference": "CIL-SUP-2026-004", "Status": "Scheduled" } ] } ], "contentType": "evidence_table" }, { "id": "follow_up_tracking", "title": "Follow-up tracking", "groups": [ { "text": "Use this table or list as the working record. Name owners, systems and evidence so a second person can apply the same rule." }, { "rows": [ { "Action ID": "IAPC-A-001", "Finding ID": "IAPC-F-001", "Action": "Close or formally re-approve cloud admin exception with residual-risk decision.", "Owner": "IT Operations Manager", "Due date": "2026-09-30", "Status": "Open", "Verification result": "Pending", "Closure evidence": "ARR-CLOSE-2026-Q3", "Notes": "Requires ISMS Manager verification." }, { "Action ID": "IAPC-A-002", "Finding ID": "IAPC-OFI-001", "Action": "Clarify supplier-specific review cadence in document register guidance.", "Owner": "Supplier Manager", "Due date": "2026-10-15", "Status": "Scheduled", "Verification result": "Not started", "Closure evidence": "DR-GUIDANCE-2026-10", "Notes": "OFI, not blocker." } ] } ], "contentType": "action_table" }, { "id": "audit_conclusion", "title": "Audit conclusion", "values": { "Overall result": "Conforms with one minor nonconformity and one opportunity for improvement", "Lead auditor conclusion": "The ISMS audit programme is suitable and evidence-based; privileged access exception handling requires corrective action.", "Management attention required?": "Yes", "Open blocker decision": "No certification blocker if corrective action is closed before external audit readiness review.", "Report date": "2026-09-15", "Evidence reference": "IAPC-REPORT-2026-Q3" }, "contentType": "decision_table" }, { "id": "validation_checklist", "title": "Validation checklist", "rows": [ { "Check ID": "AOAVC-001", "Area": "Asset identity", "What was validated": "Asset ID AST-001, asset name Production platform, owner, custodian and lifecycle status", "Required?": "Yes", "Performed by": "Asset Manager", "Approved by": "Service Owner", "Date": "2026-08-29", "Result": "Successful", "Evidence reference": "AI-AST-001-2026-Q3", "Notes": "Matches Asset Inventory." }, { "Check ID": "AOAVC-002", "Area": "Classification", "What was validated": "Confidential classification and CIA needs for Production platform", "Required?": "Yes", "Performed by": "Asset Owner", "Approved by": "ISMS Manager", "Date": "2026-08-29", "Result": "Successful", "Evidence reference": "CLASS-AST-001-2026-Q3", "Notes": "Confidentiality high, availability high." }, { "Check ID": "AOAVC-003", "Area": "Dependencies", "What was validated": "Cloud hosting, identity provider and backup dependency links", "Required?": "Yes", "Performed by": "IT Operations", "Approved by": "Service Owner", "Date": "2026-08-29", "Result": "Pending", "Evidence reference": "DEP-AST-001-2026-Q3", "Notes": "Supplier contact update pending." } ], "text": "Use this table as the main validation audit trail with one row per performed asset-owner check.", "contentType": "section" }, { "id": "evidence_reviewed", "title": "Evidence reviewed", "rows": [ { "Evidence item": "Asset Inventory extract for AST-001", "Source system / document": "Asset Inventory", "Owner": "Asset Manager", "Date reviewed": "2026-08-29", "Quality result": "Complete", "Gap identified?": "No", "Evidence reference": "AI-AST-001-2026-Q3", "Notes": "Owner and classification present." }, { "Evidence item": "Access Control Matrix for Production platform", "Source system / document": "Access Control Matrix", "Owner": "IT Operations", "Date reviewed": "2026-08-29", "Quality result": "Partial", "Gap identified?": "Yes", "Evidence reference": "ACM-APP-CRM-2026-Q3", "Notes": "Supplier contact needs update." } ], "text": "Record the evidence reviewed to support the validation conclusion.", "contentType": "section" }, { "id": "validation_decision", "title": "Validation decision", "rows": [ { "Field": "Validation result", "Value": "Conditionally accepted" }, { "Field": "Accepted by owner", "Value": "Service Owner" }, { "Field": "Reviewer", "Value": "ISMS Manager" }, { "Field": "Open blocker decision", "Value": "No access blocker; supplier contact update remains open" }, { "Field": "Final status", "Value": "Conditionally complete" }, { "Field": "Decision date", "Value": "2026-08-29" }, { "Field": "Evidence reference", "Value": "AOAVC-DEC-2026-Q3" } ], "text": "State the final validation decision.", "contentType": "section" }, { "id": "external_references", "title": "References", "groups": [ { "text": "Cite these sources from workshops and audits. This list names ISO clauses, book chapters and companion artifacts used by this file." }, { "rows": [ { "Kind": "ISO", "Reference": "ISO/IEC 27001:2022", "How this document uses it": "Normative ISMS requirements this companion artifact supports.", "href": "https://www.iso.org/standard/82875.html" }, { "Kind": "Book", "Reference": "Implementation & Certification, Internal Audit & Management Review", "How this document uses it": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification" }, { "Kind": "Artifact", "Reference": "AOAVC Asset Owner Asset Validation Checklist (Implementation & Certification, Asset Management & Information Classification)", "How this document uses it": "Interface record. Cite this Document Control version; do not copy this file into that record.", "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification" }, { "Kind": "Artifact", "Reference": "ACM Access Control Matrix (Secure Engineering, Access Control & Identity Management)", "How this document uses it": "Interface record. Cite this Document Control version; do not copy this file into that record.", "href": "https://www.amazon.com/dp/9789908983455" }, { "Kind": "Artifact", "Reference": "ARR Access Rights Register (Secure Engineering, Access Control & Identity Management)", "How this document uses it": "Interface record. Cite this Document Control version; do not copy this file into that record.", "href": "https://www.amazon.com/dp/9789908983455" }, { "Kind": "Artifact", "Reference": "DR Document Register (Building the ISMS, Context of the Organization (Clause 4))", "How this document uses it": "Interface record. Cite this Document Control version; do not copy this file into that record.", "href": "https://www.amazon.com/dp/9789908983448" } ], "text": "Use this table or list as the working record. Name owners, systems and evidence so a second person can apply the same rule." } ], "contentType": "reference_table" } ], "enrichment": { "source": "Example.json", "method": "curated-json", "note": "Completes Example JSON with renderer-native sections and generalized groups; no mdSource helper fields." }, "snapshotRef": { "snapshotId": "arcfield.platform.surv.2026-09-11", "schemaVersion": "evidenceSnapshot.v1" }, "scenarioRef": { "githubIssue": 64, "crId": "CR-TYPE-ARCFIELD-001", "family": "Checklist", "role": "Completeness check against the freeze" } }