Internal audit and management review checklist
A working checklist for the two review steps in ISO/IEC 19770-1:2017: the internal audit (clause 9.2) and the management review (clause 9.3). Use the audit checklist to plan and record an audit. Use the review checklist to prepare the pack for top management.
Part 1: Internal audit (9.2)
Plan the audit
| # | Item | Done | Notes |
|---|---|---|---|
| A1 | An audit program exists, with frequency, methods, responsibilities, planning needs and reporting. | ||
| A2 | The program reflects how important each process is and what earlier audits found. | ||
| A3 | Audit criteria and scope are written down for this audit. | ||
| A4 | Auditors are chosen so the audit is objective and impartial (no one audits their own work). |
Audit questions
Ask these of each process in your Statement of Applicability. Record what you saw, not what you were told.
| # | Question | Result | Evidence seen | Finding |
|---|---|---|---|---|
| Q1 | Does the system meet the organization's own ITAM requirements? | |||
| Q2 | Does it meet the requirements of the standard? | |||
| Q3 | Is it implemented and maintained, not just documented? | |||
| Q4 | Is the Statement of Applicability current, with a reason for each exclusion? (6.2.2) | |||
| Q5 | Does every asset have a named owner on record? (7.6.2) | |||
| Q6 | Can you trace an authorization to who, when and why, and to who carried it out? (7.6.3) | |||
| Q7 | Was the last license reconciliation done on schedule, and were gaps acted on? (8.4) | |||
| Q8 | Are outsourced activities controlled and their performance monitored? (8.7) |
Report
| # | Item | Done | Notes |
|---|---|---|---|
| R1 | Results are reported to the relevant managers. | ||
| R2 | Evidence of the program and the results is kept. | ||
| R3 | Each nonconformity has a corrective action with an owner and a date. (10.1) |
Part 2: Management review (9.3)
Top management reviews the system at planned intervals to confirm it is still suitable, adequate and effective. Put these items in the pack.
| # | Input to the review | Prepared | Source |
|---|---|---|---|
| M1 | Status of actions from the last review. | ||
| M2 | Changes in outside and inside issues that affect ITAM. | ||
| M3 | Performance trends: nonconformities and corrective actions. | ||
| M4 | Performance trends: monitoring and measurement results. | ||
| M5 | Performance trends: audit results. | ||
| M6 | ITAM activity. | ||
| M7 | Opportunities for continual improvement. | ||
| M8 | Changes in the profile of risks and opportunities. |
Outputs to record
| # | Output | Decision | Owner | Due |
|---|---|---|---|---|
| O1 | Decisions on continual improvement opportunities. | |||
| O2 | Any change needed to the ITAM system. |
Keep the minutes and the pack as evidence. The standard requires a record of the review results.
Source: ISO/IEC 19770-1:2017 clauses 9.2, 9.3 and 10.1. Paraphrased; this is not a substitute for the standard.