ISO 27001 clause 9.3 and ISO 42001 set out its inputs, including audit results, nonconformities, monitoring results and changes in risk, and require its decisions to be recorded.
See internal audit.
Read more
Related terms
- Internal audit
- An internal audit is an organization's own planned review of whether its management system or controls conform to its requirements and work as intended.
- Information security management system
- An information security management system is the set of policies, processes and responsibilities an organization uses to manage information security risk.
- ISO 42001
- ISO/IEC 42001 is the international standard for an AI management system: how an organization governs the AI systems it develops or uses.