{ "schemaVersion": "artifactDefinition.v2", "definitionId": "IAP.artifactDefinition.v2", "artifactId": "IAP", "title": "Internal Audit Plan", "artifactType": "Plan", "format": "docx", "productTier": "Basic", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable template maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "editorialStandard": { "purpose": "This plan is the freeze of one internal-audit cycle before fieldwork. It must show programme linkage, objectives, scope, criteria, independence, sampling and follow-up so an auditor can see the audit would have found what it needed to find. It is not the audit report, not the checklist pack and not management-review minutes.", "requiredEditorialElements": [ "introduction as purpose prose", "scope of this plan versus report and checklists", "terms as a first-class group", "objectives, criteria, independence and sampling before fieldwork", "audit schedule with a how-to sentence", "follow-up into corrective action", "practical examples, pitfalls, evidence and external references" ], "isoAnchors": [ { "label": "ISO/IEC 27001:2022 9.2", "href": "https://www.iso.org/standard/82875.html", "role": "Plan, establish, implement and maintain an audit programme; define criteria and scope for each audit; select auditors to ensure objectivity and impartiality." }, { "label": "ISO/IEC 27001:2022 9.2.2", "href": "https://www.iso.org/standard/82875.html", "role": "Retain documented information as evidence of the audit programme and audit results." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 2, "volumeTitle": "Implementation & Certification", "chapterId": "S-07-05-00", "chapterTitle": "Internal Audit & Management Review", "primary": true, "role": "Internal audit programme, independence and management review.", "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification" } ], "acronyms": [ { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "IAPC", "longForm": "Internal Audit Programme Checklist" }, { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SoA", "longForm": "Statement of Applicability" }, { "abbr": "API", "longForm": "Application Programming Interface" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "EV", "longForm": "Extended Validation" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "MFA", "longForm": "Multi-Factor Authentication" }, { "abbr": "RR", "longForm": "Risk Register" }, { "abbr": "SSO", "longForm": "Single Sign-On" } ], "must": [ "Define audit objectives, scope, criteria, independence limits and sampling before fieldwork.", "State follow-up: findings enter corrective action with owner and due date; they are not closed in this plan." ], "mustNot": [ "Do not let owners audit their own work without a documented limitation and compensating review.", "Do not treat this plan as the audit report.", "Do not replace this artifact's function with a shared family skeleton (operating_rules, systems_and_records)." ], "softwareCompanyAdaptations": [ "Sample privileged access, CI/CD, SaaS customer data and critical suppliers, not only policy documents.", "Use Arcfield as the worked example (cover variant A)." ], "exampleBody": { "sectionId": "audit_plan_content", "workedExampleOrg": "Arcfield", "minBodyWords": 400, "requiredGroups": [ { "id": "introduction", "heading": "What this plan is", "mustInclude": [ "before fieldwork", "not the audit report" ] }, { "id": "scope", "heading": "Scope", "mustInclude": [ "this cycle", "not the audit report" ] }, { "id": "terms", "heading": "Terms used here", "mustInclude": [ "independence", "sampling" ] }, { "id": "audit_objectives", "heading": "Audit objectives", "mustInclude": [ "conform", "effectively implemented" ] }, { "id": "auditor_independence", "heading": "Auditor independence", "mustInclude": [ "must not audit their own work" ] }, { "id": "risk_based_sampling", "heading": "Risk-based sampling", "mustInclude": [ "defined before fieldwork" ] } ], "requiredSections": [ { "id": "change_log", "title": "Revision history", "role": "Versioned freeze log with how-to sentence and rows Version, Date, Change, Approved by. Last Version matches title_page.values.Version." }, { "id": "external_references", "title": "References", "role": "ISO clauses, book chapters and companion artifacts. Not a series catalogue." } ] } }, "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use the audit plan to prove the audit was planned before evidence was sampled, not reconstructed after findings were known.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "change_log", "title": "Revision history", "contentType": "revision_table", "required": true }, { "order": 5, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Plan scope, criteria, independence and sampling before interviews start; otherwise the audit trail looks improvised.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" } }, { "order": 6, "id": "audit_plan_content", "title": "Audit plan", "contentType": "audit_plan_sections", "required": true, "requiredElements": [ "audit programme linkage", "audit objectives", "audit scope", "audit criteria", "auditor independence", "risk-based sampling", "audit schedule", "audit method", "reporting", "follow-up" ], "hint": { "text": "Write the plan as an executable schedule with criteria, owners, sample logic and reporting deadlines, not as a generic intention to audit.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" } }, { "order": 7, "id": "independence_and_sampling_model", "title": "Independence and sampling model", "contentType": "control_table", "required": true, "columns": [ { "name": "Audit area", "type": "text", "required": "yes" }, { "name": "Independence concern", "type": "text", "required": "yes" }, { "name": "Compensating measure", "type": "text", "required": "yes" }, { "name": "Sampling rule", "type": "text", "required": "yes" } ], "hint": { "text": "Independence and sampling are common audit weaknesses; make both explicit before fieldwork.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" } }, { "order": 10, "id": "evidence_and_records", "title": "Evidence and records", "contentType": "evidence_table", "required": true, "columns": [ { "name": "Evidence ID", "type": "text", "required": "yes" }, { "name": "Record type", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Retention / review rule", "type": "text", "required": "yes" }, { "name": "Typical issue", "type": "text", "required": "yes" } ], "hint": { "text": "The plan is audit-ready only when independence, sampled evidence, report dates and follow-up ownership can be retrieved.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" } }, { "order": 11, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true, "hint": { "text": "Apply References with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.", "bookReference": "Volume 2, S-07-05-00 Internal Audit & Management Review" } } ], "validationRules": [ "JSON Example must contain definitionRef pointing to IAP.artifactDefinition.v2.", "Template must include audit programme linkage, independence assessment, risk-based sampling, evidence plan and follow-up route.", "Body must include practical examples, common pitfalls and evidence expectations.", "No mdDefinition, mdExample, legacy helper sections, standalone Book reference section or generic placeholder dates are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialContractId": "editorial.docx.plan.v1", "contentContractId": "content.literary.v1", "relations": [ { "kind": "usesTemplate", "artifactId": "IAPC", "role": "auditProgramme", "expectedType": "Checklist", "rank": 2 }, { "kind": "cites", "artifactId": "AUD-ER", "role": "evidence_register", "expectedType": "Log", "rank": 1 }, { "kind": "cites", "artifactId": "MDR", "role": "evidence_register", "expectedType": "Register", "rank": 3 } ] }