ISO/IEC 27001:2022 Internal Auditor - AI

The purposes and parties of management system auditing, the ISO 19011 principles and how they interact under tension, auditor objectivity and competence, and the boundary between what ISO 19011 guides, what ISO/IEC 27001 requires, and what ISO/IEC 17021-1 governs.

Deriving programme objectives from the organization's ISMS objectives, risks and audit history; risk-based frequency and priority; defining scope and criteria for an individual audit; selecting on-site, remote or hybrid auditing methods; team composition; and testing a programme against ISO/IEC 27001 clause 9.2.

Determining the degree of verification information carries and the reliance a finding may place on it; sampling adequacy; evidence obtained by remote auditing methods; selecting collection methods; testing an Annex A control against its Statement of Applicability claim; the boundary of an ISMS audit; and what an AI-assisted evidence process establishes and leaves unverified.

Auditing clauses 4 through 10 as the yardstick rather than the syllabus - scope, leadership, the whole of clause 6, the Statement of Applicability, support, operation and measurement - together with AI systems inside ISMS scope, control effectiveness under non-determinism, and the boundary between ISMS and AI management system conformity.

Determining whether evidence constitutes a nonconformity and whether findings are systemic; classifying against a declared scheme; writing a defensible nonconformity statement; disclosing AI-assisted method in the audit report; judging corrective action adequacy; verification and closure; and what must reach clause 9.3 management review.