# PRO-07: ISMS INTERNAL AUDIT PROCEDURE
## JOHN THOMAS FINTECH PRIVATE LIMITED
**CIN:** U62099KL2026PTC106017 | **Doc ID:** JT-ISMS-PRO-007  
**Version:** 1.0 | **Effective Date:** 14-Oct-2026 | **Review Cycle:** Annual  
**ISO/IEC 27001:2022 Clause Mapping:** Clause 9.2 (Internal Audit)

---

## 1. Purpose & Scope
This procedure establishes the process for planning, conducting, reporting, and tracking internal audits of the Information Security Management System (ISMS) to ensure compliance with ISO/IEC 27001:2022, organizational security policies, and legal requirements.

## 2. Auditor Qualifications & Independence (Clause 9.2)
1. **Auditor Competence:** Internal auditors must be trained in ISO/IEC 27001:2022 standard requirements and audit techniques.
2. **Objectivity & Impartiality:** Auditors shall not audit their own work, departments, or direct deliverables (e.g., a DevOps engineer cannot audit cloud infrastructure security).

## 3. Annual Internal Audit Program Cadence
1. The ISMS must undergo a full-scope internal audit at least **once per calendar year** or prior to any major external certification/surveillance audit.
2. The audit program encompasses:
   - Mandatory Clauses 4 through 10 of ISO/IEC 27001:2022.
   - All 93 controls of ISO/IEC 27001:2022 Annex A detailed in the Statement of Applicability (`REG-02`).

## 4. Internal Audit Process Flow
1. **Audit Planning:** Lead Auditor issues the Audit Plan at least 10 business days before audit commencement, specifying scope, dates, and auditees.
2. **Execution:** Auditors conduct interviews, examine documented evidence, sample access configurations, inspect CI/CD pipelines, and review logs using `CHK-01`.
3. **Categorization of Findings:**
   - **Major Nonconformity (Major NC):** Complete absence or systemic breakdown of a required clause or control; significant risk of data breach.
   - **Minor Nonconformity (Minor NC):** Isolated lapse or inconsistency with no direct security compromise.
   - **Opportunity for Improvement (OFI):** Suggestion to optimize security practices.
4. **Audit Reporting:** Lead Auditor publishes the Internal Audit Report within 5 business days of the closing meeting.
5. **Corrective Action Tracking:** All Major and Minor NCs must be logged into the Corrective Action Register (`REG-05`) and resolved per `PRO-09`.